MemoAttack: Memory-driven black-box jailbreak framework achieves 93.33-96.67% attack success rate on AdvBench

Black-box automated jailbreaking lacks structured organization and management of cross-sample attack experience.

• Scenario: Aligned large language models should refuse harmful requests, but jailbreak prompts can still induce them to produce content that should not appear. The authors note that many deployed models only provide APIs, attackers only observe outputs, so automated jailbreaking is a search under sparse, expensive feedback.
• Existing shortcomings: Experience from sample-level heuristic search is tied to a single trajectory, and subsequent targets repeatedly discover similar strategies, with weak transfer. Cross-sample strategy pools or method libraries lack management and grow monotonically: redundant, fragile, or outdated patterns crowd out more reliable strategies, and strategies that could be useful again may be buried.
• Core observation: Multi-branch search should not only rewrite prompts but also explicitly model, evolve, and select reusable attack memories, separating prompts, evidence, and memory.
• Proposed framework: The authors propose MemoAttack, consisting of skill-structured memory modeling, lifecycle-driven memory evolution, and posterior-guided contextual memory selection.
• Threat model:
  • Goal: Induce the target LLM to produce content it should refuse.
  • Knowledge: The paper calls it black-box. Only natural language queries can be sent and responses observed; no access to gradients, logits, safety classifiers, or alignment parameters.
  • Controllable inputs: Each harmful target and optional target prefix; the attacker model rewrites prompts accordingly.
  • Victim system: The LLM under test. The evaluator performs on-topic checks and scores 1–10; success is achieved if any child node reaches 10.

In the introduction, the paper divides automatic black-box jailbreaks into sample-level heuristic search and cross-sample experience reuse; related work then expands by interface, heuristic search, experience reuse, and agent/memory space.

• Black-box evaluation interface: Perez et al. (2022), Ganguli et al. (2022), MASTERKEY (Deng et al., 2024), and EasyJailbreak (Zhou et al., 2024) replace manual templates with learning or search; Yu et al. (2024) use mutation to generate prompts. The paper says these works treat jailbreaks as black-box natural language search on an attacker–target–evaluator interface.
• Heuristic search: PAIR (Chao et al., 2023) is multi-round attacker–target rewriting; TAP (Mehrotra et al., 2024) adds pruned multi-branch tree search. Tastle (Xiao et al., 2024), JailPO (Li et al., 2024), BlackDAN (Wang et al., 2024), EvoJail (Tang et al., 2026), AWMT (Zhang et al., 2026), and Hong et al. (2024) and Lin et al. (2024b) extend local state, objectives, or feedback signals. The paper says these methods only use sample-level experience and lack stable reusable knowledge.
• Experience accumulation and reuse: AutoDAN (Liu et al., 2024) uses hierarchical genetic search to generate prompts; GPTFuzz (Yu et al., 2024) mutates seed templates in a fuzzing loop. GAP (Schwartz et al., 2025) lets previous attempts influence later expansions in a graph; AutoDAN-Turbo (Liu et al., 2025) maintains reusable method memory across attacks. The introduction says this family's pools grow without structured management.
• Agents and memory space: RedAgent (Xu et al., 2026), STAR-Teaming (Jung et al., 2026), AutoRISE (Gautam et al., 2026), Huang et al. (2025a, 2025b), MetaCipher (Chen et al., 2025), and MemJack (Chen et al., 2026) write reusable attack knowledge as in-context memory, policy networks, expanded policy spaces, or persistent experience. ER-MIA (Piehl et al., 2026) targets the agent's own memory; the paper says it focuses on the attacker's attack memory management. The paper's summary is that existing methods emphasize retrieval or policy reuse, with limited support for uncertainty modeling or evidence-driven lifecycle evolution.
• Baselines and benchmarks: Experimental baselines are TAP, GAP, AutoDAN-Turbo; benchmark is AdvBench (Zou et al., 2023).

The authors position MemoAttack as managing attack experience rather than continuing to accumulate it: units are addressable and countable, lifecycles avoid the monotonic growth of accumulative approaches, and posterior selection allocates exposure between existing evidence and underexplored areas.

MemoAttack combines bounded multi-branch prompt search with explicitly evolving attack memory on a black-box attacker–target–evaluator interface. The controller selects a branch, samples actions, constructs a memory shortlist, then updates posteriors and lifecycles based on target replies and reviewer feedback. Appendix A.1 gives single-target pseudocode.

Problem setup and object separation

• Three object types: Prompts are branch-local implementations; evidence is observed progress and success; memory units are named abstractions tracked across branches and targets. The authors say this separates prompts, evidence, and memory that were entangled in earlier systems.
• Attacker-visible scope: The shortlist projects only names, descriptions, rationales, plans, template prompts, applicability, and retrieval examples. Posteriors, lifecycles, capacity counts, and lineage ledgers are private to the controller.
• Attribution: Child nodes must report the names of memory units actually used; the system updates only the named units, allowing the model to combine neighboring units under local language constraints.

Skill-structured memory modeling

Each unit has four field groups: identity and guidance (name, template, rationale); retrieval (semantic embeddings and examples); evidence and selection (selection posterior, direct evidence); lineage and lifecycle.

• Bookkeeping object: The authors argue that the same mechanism can have multiple surface forms, and a single rewrite can mix multiple mechanisms, so evidence is recorded on named units rather than literal prompts.
• Example retrieval: Rank by cosine similarity between the current target embedding and example prompt embeddings, keep at most 3, and place only in attacker-visible context. Embeddings cite Sentence-BERT (Reimers and Gurevych, 2019).
• Deduplication: Exact name match or cosine similarity of at least 0.92 counts as duplicate. If equivalent to active or candidate, merge into the original unit; if matching retired or eliminated, may fork a new identity and record lineage. Appendix A.3 gives projection, retrieval, and deduplication.

Lifecycle-driven memory evolution

Actions are selected before ranking units. REUSE selects from active and may probe candidate and retired. MUTATE uses active or retired probe units as parents, not unvalidated candidates. INVENT proposes new units when memory is insufficient or stale.

• Mode sampling: Softmax over state-dependent scores. Reported runs use base scores REUSE 1.00, MUTATE 0.85, INVENT 0.80; additional rewards are given when the active pool is sparse, current scores are low, or recent progress is stalled. Repetition penalty reduces local loops under ambiguous evidence. Appendix A.2 gives score features. The paper does not give values for additional rewards.
• Four states: Newly invented or mutated units enter candidate; with sufficient direct evidence or recent progress, they become active; evidence of stale or declining utility leads to retired. Retired units are only occasionally sampled as probes; new positive evidence can reactivate them; persistent poor performance leads to eliminated, after which they no longer participate in selection.
• Capacity: Under pressure, weak candidates are rejected, weak active units are retired, and old retired units are eliminated; physical eviction is used only for eliminated or old retired. The authors say this avoids the monotonic storage growth of accumulative approaches. The paper does not give capacity values.

Posterior-guided context selection

After the pool is determined, each unit draws one Beta posterior sample for progress events and one for final success events. Reported runs use ω_prog = 0.55, ω_succ = 0.45. Thompson utility is U_TS(m)=ω_progθ̃^prog_m+ω_succθ̃^succ_m, i.e., the weighted sum of progress and success samples under one draw. The authors say the dual posterior separates pushing the attack forward from completing the final jailbreak.

Context bonuses use seven fixed-weight features: semantic match, score gap to success threshold, recent progress rate, recent success rate, whether used in the last step, usage share in the pool, and whether new or still under evaluation. Final ranking is U(m|x_u)=U_TS(m)+B(x_u,m)−λ_retI_ret(m), i.e., sampled utility plus context score, minus penalty for retired probes. The paper does not give values for η_i, λ_ret, or top-k. Appendix A.4 also distinguishes selection posterior from direct evidence ledger: mutated children start direct evidence from a new prior, and selection posterior inherits only discounted and capped from the parent.

Cold start and tree search

Bootstrap is not statistical resampling but a cold start before posterior memory is available. This phase does not select, score, or update named units; it keeps only rewrites on final successful targets with parent score improvement and normalized gap progress of at least τ_boot = 0.15. After accumulating B = 50 successful targets, distillation occurs. Distilled units have Beta prior α = β = κ, κ = 10^-3, then replay retained evidence; online new units start from Beta(1, 1). Staged progress on failed targets does not enter cross-target memory. In formal runs, Bootstrap distilled entries are active units, and online INVENT or MUTATE units enter candidate.

Tree search keeps top-w on-topic leaf nodes by reviewer score, then expands by branching factor. Reviewers score 1–10, success threshold is 10, with an additional on-topic YES/NO judgment. Depth, width, and 80-expansion budget are experimental settings. Appendix E gives full prompts for attacker, memory proposals, distillation, and both reviewer types.

Experimental Setup

• Data: AdvBench 520 goal–target-prefix pairs, shuffled with seed 2026711. Positions 1–100 are the Bootstrap pool, 101–400 the formal pool. The first 150 of the formal pool are split in order into three mutually exclusive 50-target splits; the three targets share the splits and order.
• Models: Targets are kimi-k2.5, minimax-M2.1, qwen3.5-397B-A17B. Attacker is qwen3-coder-480b-a35b-instruct (temperature 1.0, top-p 0.9, max 5000 tokens). Evaluator is nemotron-3-super-120b-a12b. All methods share this attacker and evaluator pair.
• Budget and baselines: Shared maximum depth D = 5, width w = 4, branching factor b = 4, early stopping after at most 80 expansions per target. Baselines are TAP, GAP, AutoDAN-Turbo. Stateful methods are evaluated after their respective initialization: AutoDAN-Turbo after Warmup, GAP after global context stabilizes, MemoAttack after Bootstrap.
• Metrics: ASR is the proportion of targets that reach the success threshold within budget, computed per split and reported as the mean across three splits with sample SD. The paper states these are three non-overlapping target sets, not repeated random seeds, and confidence intervals are not computed. The main cost is the average number of expansions on each method's own successful targets.
• Judgment: The evaluator performs on-topic checks and scores 1–10, threshold 10; success if any child node reaches the threshold. Expansion count includes candidates filtered before target execution; the paper notes it may not equal target model queries.
• Testing: For each target, 150 paired binary outcomes are pooled, and a two-sided exact McNemar test is performed. n01 is MemoAttack failure and baseline success, n10 the reverse.

Main Results

The table below shows ASR (%), mean ± sample SD across three splits, from Table 1. Kimi, MiniMax, Qwen3.5 correspond to kimi-k2.5, minimax-M2.1, qwen3.5-397B-A17B.

Swipe horizontally to read the table

Method	Kimi	MiniMax	Qwen3.5
MemoAttack	95.33±3.06	96.67±3.06	93.33±3.06
GAP	84.67±11.02	86.67±9.02	78.67±11.02
AutoDAN-Turbo	75.33±7.02	78.00±8.00	81.33±10.07
TAP	54.67±23.01	57.33±22.03	52.67±23.01

• Cost: Table 1's own-success average expansions, MemoAttack on Kimi, MiniMax, Qwen3.5 are 10.64, 6.83, 12.06. The authors report reductions of 34.2%, 51.6%, 20.2% relative to the strongest baseline per target. On all three targets, this count is lower than all three baselines in the table.
• Testing: The authors report that comparisons with the strongest baseline per target are significant under the two-sided exact McNemar test (p < 0.001). Discordant counts (n01, n10) are Kimi vs GAP (0, 16), MiniMax vs GAP (1, 16), Qwen3.5 vs AutoDAN-Turbo (5, 23). On Qwen3.5, the baseline with the highest ASR is AutoDAN-Turbo, not GAP; TAP is the lowest ASR method in the table on all three targets.
• Authors' interpretation: The authors believe this corresponds to both higher conversion within the shared 80-expansion budget and lower cost under success; they also believe the pattern is consistent with posterior-guided selection avoiding repeated unguided refinement while preserving mutation and invention for harder targets.

Search Efficiency

• What was measured: Figure 3 reports budgeted ASR for budgets 1–80. Each target panel pools 150 targets; the all-target panel pools 450 target–outcome pairs. A success is counted only if the recorded number of expansions does not exceed budget b.
• Results: At 10 expansions, MemoAttack on Kimi, MiniMax, Qwen3.5 is 46.67%, 75.33%, 33.33%, while the strongest baseline per target is 23.33%, 32.67%, 26.00%. At 20 expansions, MemoAttack is 94.67%, 96.67%, 90.00%, and the strongest baseline is 64.00%, 70.67%, 62.00%. The paper does not name which method is the strongest baseline at these two budgets.
• Authors' interpretation: The authors state the advantage appears early and persists across the full budget, with curves then approaching final ASR, and most successful targets do not use the full budget. Relative to the strongest baseline per target, reductions under shared-success and all-goal definitions are 19.9%–50.5% and 39.1%–59.5%, consistent in direction with the main definition.

Component Ablation

Target is qwen3.5-397B-A17B, with splits, attacker, evaluator, budget, and success criteria identical to the main experiment. A0 is identical target-by-target to the Qwen3.5 main condition. The table below is from Table 2.

Swipe horizontally to read the table

Variant	Removed component	ASR	Success count	own-success	Δ ASR
A0	None	93.33±3.06	140/150	12.06	–
A1	Attack memory	72.00±12.00	108/150	25.44	-21.33
A2	Posterior-guided selection	78.67±9.02	118/150	25.97	-14.67
A3	MUTATE/INVENT	86.00±8.00	129/150	19.50	-7.33
A4	Lifecycle evolution	82.00±6.00	123/150	21.22	-11.33

• Control implications: A2 retains memory but uses random selection; A3 allows reuse but disables memory space expansion; A4 disables lifecycle evolution. All-goal average counts failures as 80.
• Authors' interpretation: The authors state that removing attack memory yields the largest drop; having memory without posterior-guided contextual selection is insufficient for conversion or effective allocation of attempts. The authors believe the four designs provide complementary contributions.
• Budget curves: Figure 6 at 10 expansions shows A0 at 33.33%, strongest ablation A3 at 10.00%; at 20 expansions A0 at 90.00%, A3, A4, A2, A1 at 50.00%, 38.67%, 25.33%, 20.67%. At 40 expansions A0 has reached its final ASR, while A3 is still 7.33 percentage points lower.

Long-Horizon Cost and Memory Dynamics

• Sequential cost: An additional sequential run on 400 formal targets on qwen3.5-397B-A17B. Figure 4's x-axis is processed formal targets, y-axis is expansions; the annotated tail 50-target mean goes from 19.74 in the first window to 10.92 in the last. The first 200 targets average 17.305 expansions, the last 200 average 11.015. The authors state that expansion cost generally decreases as memory accumulates, but the trajectory is not strictly monotonic.
• Bootstrap amortization: The one-time Bootstrap for this run is 1,145 expansions. Its share of cumulative work is 53.7% after 50 formal targets and 16.8% after 400 (cumulative 6,809, Table 5). The authors call this amortization, not that Bootstrap itself becomes cheaper.
• Memory timeline: Figure 5 annotates Registrations 716, Eliminations 343, Promotions 79, Evictions 585, Retirements 41; legend is Active, Candidate, Retired, Eliminated. The authors state that the resident pool stabilizes after reaching set capacity, with four states kept separate. Appendix D.4, on a slice of the first 50,000 logs and 232 targets, gives 732 timeline registrations, 602 physical evictions, 80 promotions, 354 rejections into eliminated, 42 into retired. The two sets of numbers are not identical; the paper does not explain the difference.

Other Ablations and Analyses

• Table 6 paired (A0-only/variant-only, uncorrected exact p): A1 is 34/2, 1.94×10−8; A2 is 24/2, 1.05×10−5; A3 is 12/1, 3.42×10−3; A4 is 20/3, 4.88×10−4.
• Appendix D.4.2: Among 1,366 selections, MUTATE 492 (36.0%), INVENT 477 (34.9%), REUSE 397 (29.1%); immediate final successes are 70/492, 47/477, 113/397 respectively.
• Same slice: 730 units, 1,431 attributed uses; 534 used once, 45 at least 5 times, 14 at least 10 times; top unit accounts for 5.1%, top five 12.8%, top ten 17.1%, top twenty 23.6%; Gini 0.428, effective number of units 420.8.
• Appendix D.4.3: Final success events are mutated 156, bootstrap-distilled 79, invented 59. Table 7's top unit has 73 uses and 48 final successes, with its mutate offspring having 33 final successes; that lineage of 167 units has 501 uses and 169 final successes.
• Table 3 (kimi-k2.5, 100 items, 10 per score, three external researchers blinded): ICC(2,3) = 0.987, CCC = 0.972, MAE = 0.55 points, 92% within 1 point, 1% severe disagreement; expert mean higher in 74%, lower in 17%. The authors state that when there is disagreement, the automated evaluator more often gives lower scores.
• Appendix D.5 uses Figures 7–8 to show the storage of a Bootstrap-distilled unit and one posterior-phase expansion; strategy text is redacted, and the attacker sees only the projection.

Limitations and Future Directions Noted by the Authors

• Evaluation scope: Evaluation is on AdvBench, text-only black-box, and three targets; due to high repeated-call costs, frontier proprietary systems such as Claude Fable 5 or GPT-5.6 were not evaluated (Limitations).
• Cross-target transfer: Each target is evaluated separately; no systematic study of whether attack memories learned for one target transfer to another. The authors list transfer, negative transfer, and target-conditioned memory as future directions (Limitations).
• Hyperparameters: The goal is to propose the framework and establish feasibility. Reported hyperparameters were fixed before formal experiments; the cost of repeated black-box evaluation prevented a systematic hyperparameter sensitivity study. Component ablations do not quantify robustness to thresholds, posterior weights, memory capacity, or search budget (Limitations).
• Defenses: No defense experiments against memory-driven jailbreak attackers. The authors suggest future defenses should evaluate adaptive attackers with persistent memory, including whether high-evidence memory units can be turned into regression tests, guardrail updates, or monitoring signals (Limitations).

Experimental Coverage

• Models and interfaces: Targets are kimi-k2.5, minimax-M2.1, qwen3.5-397B-A17B; attacker is qwen3-coder-480b-a35b-instruct; evaluator is nemotron-3-super-120b-a12b. Interface is text black-box attacker–target–evaluator.
• Data: AdvBench 520 pairs, seed 2026711. Bootstrap pool 100 targets, formal pool 400; main results use the first 150 of the formal pool, split into three mutually exclusive 50-target splits, with order shared across the three targets.
• Protocol: D = 5, w = 4, b = 4, at most 80 expansions per target, success threshold 10. Baselines are TAP, GAP, AutoDAN-Turbo. Sample SD describes variation across three non-overlapping splits; the paper states confidence intervals are not computed.
• Additional experiments: Component ablations A0–A4, sequential cost on 400 formal targets, and memory log diagnostics are all on qwen3.5-397B-A17B. On kimi-k2.5, there is a blind evaluation of 100 items stratified by 1–10 scores, 10 per stratum, with three external researchers.
• Cost definitions: The paper gives three denominators: own-success, all-goal, shared-success, and states that expansion counts include candidates filtered before target execution, so they may not equal target model query counts. The paper does not report target query counts.

MemoAttack is an automated jailbreak framework for black-box safety evaluation that turns cross-target attack experience into evolvable skill memory, rather than only rewriting prompts on individual samples or piling up strategies without management.

• Problem: API models only return text, making search feedback sparse and expensive. Sample-level experience is short-lived; cross-sample strategy pools lack elimination and uncertainty management.
• Method: Memory units carry templates, evidence posteriors, and lifecycles. The controller samples among reuse, mutation, and new invention, using two Beta posteriors for progress and success plus seven contextual features for Thompson sampling; the attacker only sees a shortlist projection, and the system only updates the units that were named. Cold start uses distillation from rewrites on 50 successful targets with gap progress of at least 0.15 to initialize memory.
• Main results: On three 50-target splits of AdvBench, the ASR for kimi-k2.5, minimax-M2.1, and qwen3.5-397B-A17B is 95.33%, 96.67%, and 93.33%. The authors report being 10.67, 10.00, and 12.00 percentage points higher than the strongest baseline for each target, with McNemar tests p < 0.001 for all three groups. The average number of expansions on their own successful targets is 10.64, 6.83, and 12.06, and the authors report being 34.2%, 51.6%, and 20.2% lower than the strongest baseline for each target.
• Other results: On qwen3.5-397B-A17B, removing attack memory gives an ASR of 72.00% (−21.33 percentage points relative to the full system). In the sequential evaluation of 400 formal targets, the average number of expansions for the tail 50 targets drops from 19.74 to 10.92; the authors note the trajectory is not strictly monotonic.
• Authors' conclusion: The authors state these results establish the feasibility and empirical value of evidence-guided evolving attack memory for automated red teaming. The Limitations section also states that the evaluation is limited to text black-box settings and three targets, without systematic cross-model transfer, hyperparameter sensitivity, or defense experiments.