RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
RedEvoAgent is a black-box red-teaming agent that distills cross-case attack trajectories into a concise, human-readable attack skill. The attack skill adaptively evolves through tool-effectiveness profiling and Deciding-Tool Attribution for skill updates, and a validation ratchet that retains only updates improving validation performance. Experiments on multiple benchmarks, target models, and target execution harnesses show that RedEvoAgent outperforms fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution harnesses.
LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability. RedEvoAgent addresses these issues by distilling cross-case attack trajectories into a concise, human-readable attack skill that adaptively evolves through tool-effectiveness profiling and Deciding-Tool Attribution for skill updates, with a validation ratchet that retains only updates improving validation performance. Experiments show RedEvoAgent outperforms fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution harnesses.
RedEvoAgent introduces a skill distillation mechanism that converts full attack trajectories into concise, human-readable attack skills, reducing context overhead and improving interpretability. It uses tool-effectiveness profiling and Deciding-Tool Attribution to update skills adaptively, and a validation ratchet to ensure only performance-improving updates are retained. This approach mitigates retrieval bias and unclear tool credit issues found in trajectory-based retrieval methods.
The research highlights the growing risk of jailbreaks in product-level LLM agent execution harnesses, where harmful tool use and persistent state changes can occur. RedEvoAgent's transferability across attacker models and target execution harnesses suggests a potential for standardized red-teaming tools that can be applied across different AI systems, which may influence security practices in AI deployment.
RedEvoAgent offers a more efficient and interpretable method for automatic red-teaming of LLM-based agents, which can help organizations identify and mitigate security vulnerabilities in AI systems before deployment. Its transferability across models and harnesses could reduce the cost and effort of security testing.
Future work may focus on further improving the interpretability and efficiency of attack skill evolution, and on applying RedEvoAgent to a wider range of execution harnesses and agent architectures. The approach could also be extended to defensive applications, such as generating adversarial examples for robustness training.