{"id":"https://openalex.org/W7204465052","doi":"https://doi.org/10.48550/arxiv.2608.26008","title":"A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks","display_name":"A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks","publication_year":2026,"publication_date":"2026-08-26","ids":{"openalex":"https://openalex.org/W7204465052","doi":"https://doi.org/10.48550/arxiv.2608.26008"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.26008","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26008","pdf_url":"https://arxiv.org/pdf/2608.26008","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.26008","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148470241","display_name":"Tongyan Hu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Hu, Tongyan","raw_affiliation_strings":["National University of Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5065675832","display_name":"Bryan Hooi","orcid":"https://orcid.org/0000-0002-5645-1754","observed_orcids":["https://orcid.org/0000-0002-5645-1754"]},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Hooi, Bryan","raw_affiliation_strings":["National University of Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Singapore","institution_ids":["https://openalex.org/I165932596"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I165932596"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/multi-agent-framework","display_name":"multi-agent framework","score":0.890999972820282},{"id":"https://openalex.org/keywords/open-weight-models","display_name":"open-weight models","score":0.5920000076293945},{"id":"https://openalex.org/keywords/secondary-storage","display_name":"external memory","score":0.49000000953674316},{"id":"https://openalex.org/keywords/over-refusal","display_name":"over-refusal","score":0.5950000286102295}],"concepts":[{"id":"https://openalex.org/C89377073","wikidata":"https://www.wikidata.org/wiki/Q1171224","display_name":"Indirection","level":2,"score":0.9031999707221985},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7530999779701233},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6407999992370605},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6349999904632568},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.42410001158714294},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.41920000314712524},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.3698999881744385},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.3416000008583069},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.29670000076293945},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.27480000257492065},{"id":"https://openalex.org/C18131444","wikidata":"https://www.wikidata.org/wiki/Q163585","display_name":"Memory protection","level":5,"score":0.27320000529289246},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.2705000042915344},{"id":"https://openalex.org/C144240696","wikidata":"https://www.wikidata.org/wiki/Q367204","display_name":"Address space","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.26460000872612},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2615000009536743}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.26008","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26008","pdf_url":"https://arxiv.org/pdf/2608.26008","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.26008","doi":"https://doi.org/10.48550/arxiv.2608.26008","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.26008","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.26008","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.26008","pdf_url":"https://arxiv.org/pdf/2608.26008","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204465052.pdf","grobid_xml":"https://content.openalex.org/works/W7204465052.grobid-xml"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W4223908421","https://openalex.org/W4327810158","https://openalex.org/W4385374425","https://openalex.org/W4385848551","https://openalex.org/W4385889721","https://openalex.org/W4386907292","https://openalex.org/W4388482181","https://openalex.org/W4390041933","https://openalex.org/W4392222991","https://openalex.org/W4401042259","https://openalex.org/W4401306886","https://openalex.org/W4402667010","https://openalex.org/W4402671155","https://openalex.org/W4402671718","https://openalex.org/W4402683786","https://openalex.org/W4405655184","https://openalex.org/W4407309568","https://openalex.org/W4410609100","https://openalex.org/W4414939355","https://openalex.org/W4415797457","https://openalex.org/W4415797913","https://openalex.org/W4417172973","https://openalex.org/W6885068669","https://openalex.org/W6902634636","https://openalex.org/W7120088840","https://openalex.org/W7127179963"],"related_works":["https://openalex.org/W4399554837","https://openalex.org/W6940512168","https://openalex.org/W7163080910","https://openalex.org/W7166802255","https://openalex.org/W7160241266","https://openalex.org/W7131318652","https://openalex.org/W4392223592","https://openalex.org/W4416436479","https://openalex.org/W7077674477","https://openalex.org/W7139084277"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"(LLMs)":[3],"remain":[4,40],"vulnerable":[5],"to":[6,21,57,139],"jailbreak":[7,26,168],"attacks":[8],"that":[9,80],"exploit":[10],"techniques":[11],"such":[12],"as":[13,120,149,196],"role-playing,":[14],"obfuscation,":[15],"code":[16],"transformation,":[17],"and":[18,96,115,131,137,142,170,191],"multi-step":[19],"indirection":[20],"elicit":[22],"harmful":[23,94],"outputs.":[24],"As":[25],"strategies":[27],"keep":[28],"emerging,":[29],"defenses":[30],"have":[31],"proliferated":[32],"in":[33],"an":[34,74,111,187],"ongoing":[35],"cat-and-mouse":[36],"game,":[37],"yet":[38],"most":[39],"static:":[41],"their":[42],"safety":[43],"behavior":[44],"is":[45,156],"fixed":[46],"at":[47],"deployment,":[48],"so":[49],"they":[50],"cannot":[51],"accumulate":[52],"defensive":[53],"experience":[54],"or":[55],"adapt":[56],"unseen":[58],"strategies.":[59],"We":[60,146],"propose":[61],"a":[62,68,83],"self-evolving":[63],"test-time":[64],"defense":[65],"built":[66],"around":[67],"persistent,":[69],"cross-interaction":[70],"rule":[71,85,108],"memory:":[72],"when":[73],"attack":[75,89,113,177],"succeeds,":[76],"the":[77,87,93,116,154,157,162,197],"framework":[78],"abstracts":[79],"failure":[81],"into":[82],"method-level":[84],"capturing":[86],"structural":[88],"wrapper":[90],"rather":[91],"than":[92],"topic,":[95],"reuses":[97],"it":[98,148],"against":[99],"future":[100],"inputs.":[101],"Because":[102],"rules":[103],"are":[104],"method-level,":[105],"one":[106],"induced":[107],"generalizes":[109],"across":[110],"entire":[112],"family,":[114],"label":[117],"space":[118],"expands":[119],"novel":[121],"wrappers":[122],"appear.":[123],"The":[124],"mechanism":[125],"operates":[126],"entirely":[127],"through":[128],"external":[129],"memory":[130,198],"prompting,":[132],"with":[133],"no":[134],"parameter":[135],"updates,":[136],"applies":[138],"both":[140],"open-weight":[141],"black-box":[143,167],"API":[144],"models.":[145],"realize":[147],"four":[150,166],"cooperating":[151],"modules,":[152],"but":[153],"contribution":[155],"memory-based":[158],"adaptation":[159],"mechanism,":[160],"not":[161,193],"module":[163],"decomposition.":[164],"Across":[165],"families":[169],"multiple":[171],"models,":[172],"our":[173],"method":[174],"substantially":[175],"reduces":[176],"success":[178],"rates":[179],"while":[180],"preserving":[181],"benign":[182],"utility,":[183],"remains":[184],"robust":[185],"under":[186],"adaptive":[188],"composite-wrapper":[189],"attack,":[190],"does":[192],"increase":[194],"over-refusal":[195],"grows.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-28T00:00:00"}