构建可复用且持续进化的攻击技能库，提升自动越狱效率
JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills
- 将攻击策略封装为模块化技能，支持跨任务复用与自适应选择
- 在AdvBench上提升17.5%平均攻击成功率，对GPT-5.4提升48.6个百分点
- 攻击经验反哺技能进化，生成新策略并泛化到未见模型
自动化越狱已积累大量攻击策略，但通常分散于提示和工作流中，难以系统集成、复用与规模化改进。我们提出 extsc{JailbreakSkill}，一种以技能为中心的框架，通过可复用且持续演化的攻击能力实现自动化越狱的规模化。该框架将现有攻击策略打包为模块化、代理就绪的技能，可直接复用并自适应选择于不同任务与目标模型。除复用外，它建立了攻击与学习的闭环：攻击经验用于诊断、优化、组合与发现新技能，并反馈至不断增长的技能库中。该演化使宏观平均攻击成功率在AdvBench上提升17.5个百分点，在HarmBench上提升13.4个百分点，其中对GPT-5.4在AdvBench上提升48.6个百分点；还生成了如将直接请求重构为未完成文档补全任务等新型攻击策略。多个演化后的技能无需额外适配即可泛化至未见提示与目标模型。代码已开源。
原文摘要 · Abstract (English)
Automated red-teaming has produced a growing collection of attack strategies, yet they typically remain scattered across prompts and workflows, making them difficult to systematically integrate, reuse, and improve at scale. We introduce \textsc{JailbreakSkill}, a skill-centric framework for scaling automated red-teaming through reusable and continuously evolving attack capabilities. \textsc{JailbreakSkill} packages existing attack strategies into modular, agent-ready skills that can be directly reused and adaptively selected across tasks and target models. Beyond reuse, it closes the loop between attacking and learning: attack experience is used to diagnose, refine, combine, and discover new skills, which are added back to an ever-growing skill library. This evolution lifts macro-average ASR by 17.5 percentage points on AdvBench and 13.4 points on HarmBench, including a 48.6-point gain against GPT-5.4 on AdvBench, while yielding novel attack strategies such as reframing a direct request as an unfinished document-completion task. Several evolved skills also generalize to unseen prompts and target models without further adaptation. Our code is available at https://github.com/BattleWen/JailbreakSkill.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。