Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking

[2605.29237] Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking Skip to main content Search Submit Donate Log in Search arXiv Press Enter to search · Advanced search Computer Science > Cryptography and Security arXiv:2605.29237 (cs) [Submitted on 28 May 2026 ( v1 ), last revised 15 Aug 2026 (this version, v2)] Title: Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking Authors: Junke Zhang , Jianwei Wang , Sishuo Chen , Yizhang He , Qingshuai Feng , Zhengyi Yang View a PDF of the paper titled Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking, by Junke Zhang and 5 other authors View PDF HTML (experimental) Abstract: Jailbreak attacks on large language models (LLMs) aim to induce LLMs to produce content that they are expected to refuse. Automated black-box jailbreak generation is important for safety evaluation, where the attacker observes only model outputs and needs to search for effective adversarial prompts. Existing black-box jailbreak methods either depend on sample-wise heuristic search or leverage attack experience through accumulating strategy pools or method libraries, lacking a systematic organization and management of attack experience. To mitigate these drawbacks, we propose MemoAttack, a memory-driven black-box jailbreak framework with comprehensive attack memory modeling, evolution, and selection. Specifically, MemoAttack comprises three key designs: (1) Skill-Structured Memory Modeling, which abstracts accumulated attack experience into reusable skill-structured attack memory whose units pair attack skills with templates, evidence, and lifecycle state; (2) Lifecycle-Driven Memory Evolution, which evolves the memory through evidence-based probation, promotion, retirement, reactivation, elimination, and storage cleanup; and (3) Posterior-Guided Contextual Memory Selection, which balances reliable memory reuse with uncertainty-driven exploration via contextual Thompson sampling. Across three target models on AdvBench, MemoAttack achieves attack success rates of 93.33-96.67%, exceeding the strongest baseline on each target by 10.00-12.00 percentage points while reducing mean expansion cost on its own successful goals by 20.2-51.6%. In a sequential 400-goal evaluation on Qwen3.5, the trailing 50-goal mean expansion-attempt count decreases overall from 19.74 to 10.92 as memory accumulates. Comments: Under review Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.29237 [cs.CR] (or arXiv:2605.29237v2 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2605.29237 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Jianwei Wang [ view email ] [v1] Thu, 28 May 2026 01:53:14 UTC (709 KB) [v2] Sat, 15 Aug 2026 00:47:06 UTC (667 KB) Full-text links: Access Paper: View a PDF of the paper titled Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking, by Junke Zhang and 5 other authors View PDF HTML (experimental) TeX Source view license Current browse context: cs.CR < prev | next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar export BibTeX citation Loading... BibTeX formatted citation × loading... Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab) Major funding support from

Related documents

• Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking#609953
• Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking#238528
• `From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMs#635568
• `From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMs#633219
• SBIRT Intervention for Gambling Behaviors#992440