用大模型自进化防御黑盒攻击，无需重训即可应对新攻击。
EvoDefense: Co-Evolving Black-Box Defense with Large Language Models
- 用守护大模型与经验记忆协同演化，动态优化防御策略。
- 在五种攻击下将攻击成功率从43.4%降至6.2%，通用性强。
- 适合需要持续防护的AI系统，尤其对抗未知攻击场景。
大型语言模型（LLMs）在黑盒攻击下仍极易受攻击，现有防御依赖预设过滤规则，难以泛化到未见攻击类型和模型架构。本文提出EvoDefense，一种基于经验引导的协同进化黑盒防御范式。该方法通过守护大模型检测恶意查询，并利用经验记忆模块积累过往交互中的防御知识。核心是攻击与防御的持续演化循环：攻击生成器与守护模型通过经验引导优化，不断迭代改进攻击策略与防御政策。此设计使EvoDefense无需重新训练即可泛化至未见攻击和目标模型。在HarmBench、AdvBench和AlpacaEval上的实验表明，EvoDefense在七种主流模型和五类代表性攻击中均表现出稳定的强防御性能，同时保持良好通用能力。在HarmBench上，其将AutoDAN-turbo对Gemini-3-flash和LLaMA-3-8B-Instruct的攻击成功率从29.4%和43.4%分别降低至8.4%和6.2%。
原文摘要 · Abstract (English)
Large Language Models (LLMs) remain highly vulnerable to diverse attacks, particularly in black-box settings where the internals of target models are inaccessible. Existing black-box defenses typically rely on pre-defined filtering heuristics, which often fail to generalize to unseen attack types and target model architectures. We introduce EvoDefense, an experience-guided co-evolving black-box defense paradigm. EvoDefense employs a guard LLM to detect malicious queries and an experience memory module to accumulate defense knowledge from previous interactions. At the core of EvoDefense is a continuous attack-defense evolution loop, where an attack generator and the guard model iteratively refine their attack strategies and defense policies through experience-guided optimization. This design enables EvoDefense to generalize across unseen attacks and target models without retraining. Experiments on HarmBench, AdvBench, and AlpacaEval show that EvoDefense achieves consistently strong defense performance across seven popular models and five representative LLM attacks, while preserving competitive general capabilities. On HarmBench, EvoDefense reduces the attack success rate (ASR) of AutoDAN-turbo on Gemini-3-flash and LLaMA-3-8B-Instruct from 29.4% and 43.4% to 8.4% and 6.2%, respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。