Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution

• URL: http://arxiv.org/abs/2605.13411v1
• Date: Wed, 13 May 2026 12:07:05 GMT
• Title: Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution
• Abstract summary: EvoSafety is a safety framework built around persistent, inspectable, and reusable external structures.<n>For red teaming, EvoSafety equips the attack policy with an adversarial skill library, enabling continued vulnerability probing.<n>For defense learning, EvoSafety replaces model-specific safety fine-tuning with a lightweight auxiliary defense model augmented with memory retrieval.
• Score: 43.00984815993804
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large language models remain vulnerable to adversarial prompts that elicit harmful outputs. Existing safety paradigms typically couple red-teaming and post-training in a closed, policy-centric loop, causing attack discovery to suffer from rapid saturation and limiting the exposure of novel failure modes, while leaving defenses inefficient, rigid, and difficult to transfer across victim models. To this end, we propose EvoSafety, an LLM safety framework built around persistent, inspectable, and reusable external structures. For red teaming, EvoSafety equips the attack policy with an adversarial skill library, enabling continued vulnerability probing through simple library expansion after saturation, while supporting the evolution of adversarial vectors. For defense learning, EvoSafety replaces model-specific safety fine-tuning with a lightweight auxiliary defense model augmented with memory retrieval. This enables efficient, transferable, and model-agnostic safety improvements, while allowing robustness to be enhanced solely through memory updates. With a single training procedure, the defense policy can operate in both Steer and Guard modes: the former activates the victim model's intrinsic defense mechanisms, while the latter directly filters harmful inputs. Extensive experiments demonstrate the superiority of EvoSafety: in Guard mode, it achieves a 99.61% defense success rate, outperforming Qwen3Guard-8B by 14.13% with only 37.5% of its parameters, while preserving reasoning performance on benign queries. Warning: This paper contains potentially harmful text.

Related papers

• Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack [19.201635180438313]
  Large language models (LLMs) are rigorously aligned to refuse harmful requests.<n>In this work, we reveal that this advanced safety awareness inadvertently introduces a fatal vulnerability.
  arXiv  Detail & Related papers  (2026-06-04T02:36:41Z)
• CHASE: Adversarial Red-Blue Teaming for Improving LLM Safety using Reinforcement Learning [11.739543857396775]
  We introduce CHASE, a teaming framework in which a black-box attacker and a safety-aligned defender co-evolve.<n> CHASE cuts mean StrongREJECT score by 43.2% with 0% false-refusal on benign prompts.<n>Beyond the headline result, CHASE shows that template-free RL exploration recovers latent attack primitives that transfer across mechanistically distinct attack families.
  arXiv  Detail & Related papers  (2026-06-04T00:06:13Z)
• EVA: Editing for Versatile Alignment against Jailbreaks [85.18411558566851]
  EVA (Editing for Versatile Alignment against Jailbreaks) is a novel framework that pioneers the application of direct model editing for safety alignment.<n> EVA identifies and surgically edits specific neurons responsible for the model's susceptibility to harmful instructions.<n>It effectively neutralizes harmful behaviors without compromising the model's general reasoning capabilities.
  arXiv  Detail & Related papers  (2026-05-14T12:16:10Z)
• RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic [56.38397499463889]
  Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks.<n>However, they remain vulnerable to hazardous instructions that may trigger unsafe behaviors.<n>We propose RoboSafe, a runtime safeguard for embodied agents through executable predicate-based safety logic.
  arXiv  Detail & Related papers  (2025-12-24T15:01:26Z)
• SAID: Empowering Large Language Models with Self-Activating Internal Defense [23.654016424365906]
  We introduce a new, training-free defense paradigm, Self-Activating Internal Defense (SAID)<n>SAID reframes the defense task from external correction to internal capability activation.<n>It substantially outperforms state-of-the-art defenses in reducing harmful outputs.
  arXiv  Detail & Related papers  (2025-10-23T02:07:54Z)
• SVDefense: Effective Defense against Gradient Inversion Attacks via Singular Value Decomposition [2.770477290556769]
  Federated learning (FL) enables collaborative model training without sharing raw data but is vulnerable to gradient inversion attacks (GIAs)<n>We propose SVDefense, a novel defense framework against GIAs that leverages the truncated Singular Value Decomposition (SVD) to obfuscate gradient updates.<n> SVDefense is practical for deployment on various resource-constrained embedded platforms.
  arXiv  Detail & Related papers  (2025-10-01T03:25:41Z)
• SafeSteer: Adaptive Subspace Steering for Efficient Jailbreak Defense in Vision-Language Models [25.027627636905475]
  We propose SafeSteer, a lightweight, inference-time steering framework.<n>We show that SafeSteer reduces the attack success rate by over 60% and improves accuracy on normal tasks by 1-2%.
  arXiv  Detail & Related papers  (2025-09-24T12:46:41Z)
• Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security [63.41350337821108]
  We propose Secure Tug-of-War (SecTOW) to enhance the security of multimodal large language models (MLLMs)<n>SecTOW consists of two modules: a defender and an auxiliary attacker, both trained iteratively using reinforcement learning (GRPO)<n>We show that SecTOW significantly improves security while preserving general performance.
  arXiv  Detail & Related papers  (2025-07-29T17:39:48Z)
• Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training [67.30423823744506]
  We introduce a novel approach, Decoupled Refusal Training (DeRTa), designed to empower LLMs to refuse compliance to harmful prompts at any response position.<n>DeRTa incorporates two novel components: (1) Maximum Likelihood Estimation with Harmful Response Prefix, which trains models to recognize and avoid unsafe content by appending a segment of harmful response to the beginning of a safe response, and (2) Reinforced Transition Optimization (RTO), which equips models with the ability to transition from potential harm to safety refusal consistently throughout the harmful response sequence.
  arXiv  Detail & Related papers  (2024-07-12T09:36:33Z)
• BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models [57.5404308854535]
  Safety backdoor attacks in large language models (LLMs) enable the stealthy triggering of unsafe behaviors while evading detection during normal interactions. We present BEEAR, a mitigation approach leveraging the insight that backdoor triggers induce relatively uniform drifts in the model's embedding space. Our bi-level optimization method identifies universal embedding perturbations that elicit unwanted behaviors and adjusts the model parameters to reinforce safe behaviors against these perturbations.
  arXiv  Detail & Related papers  (2024-06-24T19:29:47Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.