Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking

Abstract

Jailbreak attacks on large language models (LLMs) aim to induce LLMs to produce content that they are expected to refuse. Automated black-box jailbreak generation is important for safety evaluation, where the attacker observes only model outputs and needs to search for effective adversarial prompts. Existing black-box jailbreak methods either depend on sample-wise heuristic search or leverage attack experience through accumulating strategy pools or method libraries, lacking a systematic organization and management of attack experience. To mitigate these drawbacks, we propose MemoAttack, a memory-driven black-box jailbreak framework with comprehensive attack memory modeling, evolution, and selection. Specifically, MemoAttack comprises three key designs: (1) Skill-Structured Memory Modeling, which abstracts accumulated attack experience into reusable skill-structured attack memory whose units pair attack skills with templates, evidence, and lifecycle state; (2) Lifecycle-Driven Memory Evolution, which evolves the memory through evidence-based probation, promotion, retirement, reactivation, elimination, and storage cleanup; and (3) Posterior-Guided Contextual Memory Selection, which balances reliable memory reuse with uncertainty-driven exploration via contextual Thompson sampling. Across three target models on AdvBench, MemoAttack achieves attack success rates of 93.33-96.67%, exceeding the strongest baseline on each target by 10.00-12.00 percentage points while reducing mean expansion cost on its own successful goals by 20.2-51.6%. In a sequential 400-goal evaluation on Qwen3.5, the trailing 50-goal mean expansion-attempt count decreases overall from 19.74 to 10.92 as memory accumulates.