RedDarwin: Evolving Jailbreak Skills Against Frontier LLMs

This paper attempts to address the difficulty existing jailbreak methods have in keeping up with the rapidly iterating safety defenses of frontier large language models (LLMs), as well as the problem that existing automated red teaming methods are limited to fixed strategies or prompt search.

• Scenario and importance: As the safety alignment capabilities of frontier LLMs strengthen, pre-designed jailbreak prompt templates often become ineffective, and attacks developed for one model transfer poorly to other models (the authors cite [4, 47]). Automated red teaming requires systematic methods that can continuously adapt and discover stronger attack pipelines.
• Shortcomings of existing methods: Most existing automated red teaming work is limited to a fixed strategy space, single prompt mutation, or a fixed attack algorithm framework (e.g., optimizing a specific prompt, greedy mutation), and fails to systematically convert the attack algorithms accumulated in the jailbreak literature into executable objects that an agent can directly modify, combine, and accumulate.
• Core observation and hypothesis: The authors argue that even if a specific attack method fails on the target model, its underlying core mechanisms (e.g., search procedures, context manipulation, inverse causality, role-playing) remain effective and can evolve into stronger attacks after revision or cross-method recombination.
• What the paper proposes: The paper proposes the REDDARWIN framework, which shifts the unit of evolution from adversarial prompts or fixed attack scripts to executable attack skills, automatically evolving the attack library through three operators: single-skill revision, multi-skill combination, and new-skill discovery.
• Threat model:
  • Attacker goal: induce aligned frontier LLMs to generate specific, actionable harmful content in response to harmful instructions (a fully compliant response scoring 5 under the Qi et al. [52] rubric).
  • Attacker knowledge: black-box access; the attacker cannot obtain the target model's parameters or gradients.
  • Attacker capability: can send multi-turn or single-turn interaction requests via API and dynamically adjust inputs and code logic within the target query budget; the evolution stage uses an auxiliary code-execution agent (K3 in Kimi-CLI).
  • Victim systems: frontier commercial and open-source large language models with safety alignment mechanisms deployed (e.g., GPT-5.6-Luna, GPT-5.6-Sol, Claude-Sonnet-5, Gemini-3.8-Flash, etc.).

The related work discussed in the paper is mainly divided into three directions: jailbreak attacks and composition, agentic automated red teaming, and skill construction and evolution:

• Jailbreak Attacks and Composition
  • Adversarial Déjà Vu (Dabas et al., 2026): Decomposes jailbreak attacks into reusable primitives to characterize unseen attacks;
  • ReNeLLM (Ding et al., 2024): Combines prompt rewriting with nested scenarios;
  • h4rm3l (Doumbouya et al., 2025) and Chimera (Park et al., 2026): Search over transformation compositions and heterogeneous attack strategies, respectively;
  • Claudini (Panfilov et al., 2026) and EvoSynth (Chen et al., 2026): Evolve executable adversarial code or code-level jailbreak algorithms through coding agents. The authors note that REDDARWIN focuses on the evolution of executable black-box skills that include heterogeneous processes such as search and multi-round interaction.
• Agentic Red Teaming
  • GPTFuzzer (Yu et al., 2023), PAIR (Chao et al., 2023), and TAP (Mehrotra et al., 2024): Iteratively search for adversarial prompts based on target model feedback;
  • AutoDAN-Turbo (Liu et al., 2024) and AutoRedTeamer (Zhou et al., 2025): Reuse successful attack strategies;
  • JailbreakSkill (Wen et al., 2026), MemoAttack (Zhang et al., 2026), and RedEvoAgent (Zhang et al., 2026): Organize attack knowledge into skills or memory. The authors note that the object of evolution in REDDARWIN is the complete attack execution flow, including code and control flow.
• Skill Construction and Evolution
  • Voyager (Wang et al., 2023): Lets agents accumulate environment experience through a continuously expanding library of executable programs;
  • SkillOpt (Yang et al., 2026) and SkillOpt-Lite (Shen et al., 2026): Optimize skill files using execution traces and feedback. The authors transfer this paradigm to the discovery of adversarial algorithms.
• Baseline methods and benchmarks
  • Comparison baselines: In the constrained-query-budget evaluation, TAP, AutoDAN-Turbo, and JailbreakSkill were compared;
  • Benchmark datasets: The evolution and development stages use AdvBench-50, and the generalization and adaptive red teaming evaluation uses StrongREJECT-50.
• Positioning difference: The authors state that most existing automated red teaming or prompt optimization methods search within a predefined attack process or strategy space, whereas REDDARWIN is the first to transform 47 jailbreak attacks from heterogeneous literature into executable skills with a common interface, and supports single-skill modification, cross-skill mechanism composition, and new mechanism discovery.

REDDARWIN formalizes adaptive red teaming as an evolutionary process over a population of executable attack skills; the core idea is to package jailbreak algorithms as executable skills that expose their internal control flow, and to iteratively improve and expand them via three operators based on target model feedback.

Problem Setting and Formalization

• The paper formalizes an attack skill as a mapping: s : (x, M, ξ) ↦ (τ, y) where x is the attack target, M is the target model, ξ is the attack configuration and resources, τ is the interaction trajectory, and y is the final response of the target model.
• The initial population of the skill library contains 47 executable base skills from 10 attack categories (covering single-turn and multi-turn interaction).

Skill-Level Evolution Operators

• Single-Skill Revision: uses a single parent skill as prior and comparison baseline, keeps its core mechanism unchanged, and modifies the code modules that caused failure (e.g., prompt construction, search control, interaction logic, intermediate state handling, or parameters).
• Multi-Skill Combination: extracts compatible mechanisms from two parent skills and integrates them into a coherent executable pipeline. To measure a skill's reproductive utility, an offspring-rewarded selection mechanism is used, maintaining a Beta-distribution sampling probability for skill i: θ_i ∼ Beta(1 + ∑_{c ∈ 𝒞i} R(c),  1 + ∑_{c ∈ 𝒞i} (1 − R(c))) where 𝒞_i is the set of evaluated offspring of skill i, and R(c) ∈ [0, 1] is the offspring's average ASR on the development targets.
• New-Skill Discovery: no fixed parent skill is specified; the evolution agent proposes entirely new execution strategies based on current population mechanisms and historical failure experience (e.g., introducing an auxiliary compiler to generate reverse-engineering tasks or lost-information repair tasks).

Feedback-Driven Iterative Refinement and Selection

• Refinement step: the evolution agent updates a candidate based on the candidate skill's current execution trajectory 𝒯, immediate reward R(s̃^(k)), and globally accumulated historical evidence ℋ: s̃^(k+1) = 𝒢(s̃^(k), 𝒯(s̃^(k)), R(s̃^(k)), ℋ)
• Retention criterion: the candidate skill's average ASR R(s̃) is evaluated on the development set, and the candidate is retained in the library only if it strictly outperforms the reference performance R_ref(s̃) (the revision operator compares against the original base skill, the combination operator against the stronger parent, and the discovery operator against related population skills); otherwise it is discarded (but the trajectory is recorded in the history ℋ).
• Tool configuration: the evolution agent uses the K3 model in Kimi-CLI, together with run, evaluation, and logging tools, to complete end-to-end iteration. After evolution, the skill library is frozen for subsequent evaluation.

Experimental Setup

• Models under test: Development-stage models include Qwen3.7-Flash, GPT-OSS-120B, DeepSeek-V4-Flash-0731, and GPT-5.6-Luna; unseen generalization models include GLM-5.3-Flash, Gemini-3.8-Flash, and MiniMax-M3; adaptive red teaming additionally evaluated Claude-Sonnet-5 and GPT-5.6-Sol.
• Datasets: The development stage uses AdvBench-50 (50 harmful goals); generalization and adaptive evaluation use StrongREJECT-50 (50 goals).
• Comparison baselines: In the adaptive red teaming evaluation, TAP, AutoDAN-Turbo, and JailbreakSkill were compared.
• Metric and judging method: Attack success rate (ASR) is the primary metric. deepseek-v4-flash-0423 is used as the unified judge model; according to the 5-point scale of Qi et al. [52], only a score of 5 (fully compliant and containing specific actionable harm) is counted as success. Manual sampling review showed 95% and 96% agreement with model judgments (Table 11).
• Sample size and number of repetitions: Development set 50 questions × 4 targets; generalization set 50 questions × 7 targets (350 responses per skill); adaptive evaluation limits each target to a maximum budget of 10 queries (ASR@b).

Main Results

Cross-model and cross-benchmark transfer performance on 50 StrongREJECT targets (according to Table 1, showing representative base skills and the top skills of each evolution category):

Swipe horizontally to read the table

• The authors' interpretation of the main results:
  • The selected evolved skills achieve an average ASR of 76.3% on StrongREJECT, higher than the 38.5% of the corresponding selected base skills; on unseen models, the average ASR reaches 64.6%, higher than the 37.5% of the base skills.
  • The relative effectiveness of skills shows transfer shifts across models; for example, CensureCite is 96.5% on the development set but only 12% on Gemini-3.8-Flash, whereas RACE 2.0 reaches 84% on Gemini (the highest for that model).

Constrained-budget adaptive red teaming evaluation

• What was tested: On 50 StrongREJECT targets, a coding agent was equipped with the evolved skill library, with each target limited to at most 10 calls to the target model (Figure 3).
• Results: REDDARWIN equipped with Kimi-Code achieves ASR@10 of 80%, 92%, and 100% on Gemini-3.8-Flash, Claude-Sonnet-5, and GPT-5.6-Sol, respectively, higher than TAP (54%, 26%, 26%), AutoDAN-Turbo (34%, 14%, 36%), and JailbreakSkill (68%, 30%, 46%).
• The authors' interpretation: The evolved skills provide high-quality initial attack procedures; on Claude and GPT-5.6-Sol, the first-round query ASR already exceeds the full-budget ASR of all baselines; REDDARWIN finds on average 2.6 different effective skills per target within 10 queries.

Skill set ablation experiment

• What was tested: On 20 targets, Grok-Build (Grok-4.6) and Kimi-Code (Kimi-K3) were compared under no skills, base skills only, and all skills (including evolved skills) (Table 2).
• Results: On Gemini-3.8-Flash, Kimi-Code achieves ASR@10 of 25%, 50%, and 75% under no skills, base skills, and all skills, respectively; Grok-Build achieves 30% and 50% under no skills and all skills, respectively.
• The authors' interpretation: Evolved skills improve the red teaming performance of both agents, but the two agents benefit to different degrees, indicating that attack effectiveness depends not only on skill quality but also on the agent's ability to select and modify skills based on feedback.

Other ablations and analyses

• Evolution output and improvement ratio: 72 candidate skills were evaluated and 65 retained; single-skill modification improved ASR for 44/47 base skills, with average ASR rising from 18.8% to 47.3% (Figure 2).
• Multi-skill composition gain: Multi-skill compositions improve on their stronger parent skill by an average of 10.7 percentage points on the development set; new skill discovery achieves an average development ASR of 83.2% (Section 4.2).
• Functional module modification and retention: Interaction semantics and output requirements were modified most often (36 and 43 times, respectively); input representation was modified less often (32 times) but had a high retention ratio (Figure 4a, Figure 7a).
• Multi-round modification evolution: Across 4 rounds of iteration on 4 skills, FlipAttack, DarkCite, and PastTense ultimately outperformed their first-round revised versions, whereas later versions of CodeChameleon showed performance regression (Figure 9).
• Negative and anomalous results: After modification, CipherChat's ASR dropped from 13.0% to 5.0%, AutoDAN-Turbo's dropped from 13.5% to 2.5%, and AdversarialTales' dropped from 62.5% to 62.0% (Table 4). NarrDetailDecomp's ASR after composition (65.0%) is lower than its stronger parent (Table 5). Palimpsest's ASR on GPT-5.6-Luna is 0% (Table 5).

Limitations and Future Directions Noted by the Authors

• Evaluated only on English harmful targets: The authors note in Limitations that the study was evaluated only on English harmful requests and has not yet covered multilingual safety boundaries.
• Reliance on a single automated LLM judge model: The authors note that evaluation primarily relies on a single automated LLM judge model (deepseek-v4-flash-0423); despite manual consistency spot checks, possible evaluation bias remains.
• High evolutionary computation and token cost: The authors note that the evolution process requires substantial LLM requests and token consumption (each evolution trajectory consumes an average of 305,000 input tokens and takes about 6.94 hours, per Table 10).
• No testing against targeted adaptive defenses: The authors note in the discussion that the study did not evaluate defenses with adaptive detection or defenses designed specifically for algorithm evolution.

Experimental Coverage

• Target model coverage: The development stage evaluated 4 models in total: Qwen3.7-Flash, GPT-OSS-120B, DeepSeek-V4-Flash-0731, and GPT-5.6-Luna; the generalization evaluation added GLM-5.3-Flash, Gemini-3.8-Flash, and MiniMax-M3; adaptive red teaming included Gemini-3.8-Flash, Claude-Sonnet-5, and GPT-5.6-Sol.
• Benchmark dataset coverage: The development and evolution stages used AdvBench-50 (50 targets); cross-model transfer and adaptive red teaming evaluation used StrongREJECT-50 (50 targets); four-skill continuous evolution used AdvBench-100 (100 targets).
• Scale of skill evolution: Based on 47 executable base skills, 72 candidate skills were evaluated in total and 65 were retained (including 47 single-skill revisions, 15 multi-skill combinations, and 10 new-skill discoveries).
• Query budget and stage settings: In adaptive red teaming tests, each attack target was limited to at most 10 calls to the target model.
• Information not reported in the paper: The paper does not report evaluation results on multilingual datasets, multimodal targets, or non-jailbreak safety risks (such as hallucination or unauthorized agent tool invocation).

• One-sentence positioning: REDDARWIN proposes an automated red-teaming framework whose evolutionary unit is the "executable attack skill"; it automatically evolves and accumulates jailbreak algorithms through target-model feedback.
• Problem addressed: Continuous updates to frontier-model defenses cause preset jailbreak prompts and fixed attack pipelines to fail quickly, while existing automated red-teaming methods are usually limited to specific prompt search or a fixed strategy space, making it hard to reuse and evolve attack mechanisms from existing literature.
• Method highlights: 47 jailbreak methods from the literature are implemented as executable skills with complete control flow; code and interaction pipelines are iterated through three operators—single-skill Revision, multi-skill Combination (with Beta-distribution breeding-utility sampling), and new-skill Discovery—and successful skills accumulate into a dynamic skill library.
• Key experimental results:
  • On the AdvBench-50 development set, single-skill revision improves 44/47 attacks, raising mean ASR from 18.8% to 47.3% (Table 4);
  • Selected evolved skills achieve mean ASR of 64.6% on unseen models and StrongREJECT-50, significantly higher than the 37.5% of base skills (Table 1);
  • In adaptive red-teaming tests with a budget of 10 queries per target, REDDARWIN achieves ASR@10 of 80%, 92%, and 100% against Gemini-3.8-Flash, Claude-Sonnet-5, and GPT-5.6-Sol, respectively (Figure 3).
• Authors' conclusions and implications: The authors argue that jailbreak research is not only a static sample of attack-defense testing but also a foundational component of algorithm evolution; high-intensity jailbreak attacks often arise from recombinations of different mechanisms (e.g., combining inverse causality, character rearrangement, and multilingual wrapping), and building a reusable skill library can accelerate red-team exploration and provide reference for model defenses.