Paper "Lifelong Safety Alignment for Language Models"

Wang et al.'s paper formalizes the confrontation between jailbreak attackers and model defenders as a competitive co-evolutionary framework: Meta-Attacker uses GPT-4o to extract and generalize attack strategies from published jailbreak research papers, with an initial attack success rate of 73% and a transfer success rate of 57% on another benchmark. After multiple rounds of iterative fine-tuning by the defender, the attack success rate drops to about 7%, and Meta-Attacker's effectiveness tends to plateau. The framework is deployed for an "unrestricted environment" without pre-filtering. The paper does not report utility metrics alongside safety metrics, nor does it discuss computational cost or out-of-distribution attack categories; Failure-First believes the residual 7% of attacks may exploit reasoning-level vulnerabilities.