{"id":"https://openalex.org/W7163689457","doi":"https://doi.org/10.48550/arxiv.2606.05743","title":"Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense","display_name":"Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense","publication_year":2026,"publication_date":"2026-06-04","ids":{"openalex":"https://openalex.org/W7163689457","doi":"https://doi.org/10.48550/arxiv.2606.05743"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.05743","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.05743","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.05743","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137944395","display_name":"Minseok Choi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Choi, Minseok","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137979744","display_name":"Seungbin Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Seungbin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100393166","display_name":"Dong-Jin Kim","orcid":"https://orcid.org/0009-0001-6780-245X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Dongjin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137965507","display_name":"Subin Kim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Subin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128108663","display_name":"Jungmin Son","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Son, Jungmin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137968917","display_name":"Yunseung Lee","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lee, Yunseung","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047912015","display_name":"Jaegul Choo","orcid":"https://orcid.org/0000-0003-1071-4835"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Choo, Jaegul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137999367","display_name":"Youngjun Kwak","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kwak, Youngjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.828000009059906,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.828000009059906,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.020600000396370888,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.018200000748038292,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6338000297546387},{"id":"https://openalex.org/keywords/memory-cell","display_name":"Memory cell","score":0.47699999809265137},{"id":"https://openalex.org/keywords/human-memory","display_name":"Human memory","score":0.4634000062942505},{"id":"https://openalex.org/keywords/false-memory","display_name":"False memory","score":0.3418000042438507},{"id":"https://openalex.org/keywords/blocking","display_name":"Blocking (statistics)","score":0.3280999958515167}],"concepts":[{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6338000297546387},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.607699990272522},{"id":"https://openalex.org/C2776638159","wikidata":"https://www.wikidata.org/wiki/Q18343761","display_name":"Memory cell","level":4,"score":0.47699999809265137},{"id":"https://openalex.org/C2985957978","wikidata":"https://www.wikidata.org/wiki/Q492","display_name":"Human memory","level":3,"score":0.4634000062942505},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3889000117778778},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3806000053882599},{"id":"https://openalex.org/C2779086471","wikidata":"https://www.wikidata.org/wiki/Q2051704","display_name":"False memory","level":3,"score":0.3418000042438507},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.3280999958515167},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2567000091075897},{"id":"https://openalex.org/C82687282","wikidata":"https://www.wikidata.org/wiki/Q66221","display_name":"Auxiliary memory","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.25189998745918274}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.05743","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.05743","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.05743","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.05743","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6609212160110474}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Despite":[0],"advances":[1],"in":[2],"safety":[3,16,114,118,123],"alignment,":[4],"large":[5],"language":[6],"models":[7],"remain":[8,162],"vulnerable":[9],"to":[10,20,29],"continuously":[11],"evolving":[12,22],"jailbreaks.":[13],"Existing":[14],"fine-tuned":[15],"classifiers":[17],"cannot":[18],"adapt":[19],"these":[21],"attacks,":[23],"while":[24],"adaptive":[25],"memory-based":[26],"guardrails":[27],"tend":[28],"over-refuse":[30],"benign":[31,66,80,137],"queries":[32],"that":[33,93],"resemble":[34],"stored":[35],"attacks.":[36,135],"We":[37],"propose":[38],"Membrane,":[39],"a":[40,56,63,83],"self-evolving":[41],"guardrail":[42],"built":[43],"on":[44,119,124,131,139],"Contrastive":[45],"Safety":[46],"Memory":[47,152],"(CSM):":[48],"each":[49,75],"cell":[50,85,95],"pairs":[51],"the":[52,88,101,128,146],"conditions":[53],"for":[54,61,112],"blocking":[55],"harmful":[57,76],"query":[58],"with":[59],"those":[60],"permitting":[62],"superficially":[64],"similar":[65],"request.":[67],"Without":[68],"retraining,":[69],"Membrane":[70,126],"evolves":[71],"CSM":[72],"by":[73,87],"distilling":[74],"interaction":[77],"and":[78,121,161],"its":[79],"counterpart":[81],"into":[82],"contrastive":[84],"indexed":[86],"underlying":[89],"attack":[90],"strategy,":[91],"so":[92],"one":[94],"generalizes":[96],"across":[97],"topical":[98],"variants":[99],"of":[100,149],"same":[102],"mechanism.":[103],"At":[104],"inference,":[105],"retrieved":[106],"cells":[107,153],"serve":[108],"as":[109],"grounding":[110],"context":[111],"precise":[113],"decisions.":[115],"Across":[116],"model-level":[117],"HarmBench":[120],"agent-level":[122],"AgentHarm,":[125],"achieves":[127],"highest":[129],"F1":[130,157],"all":[132],"six":[133],"jailbreak":[134],"Notably,":[136],"refusal":[138],"AgentHarm":[140],"stays":[141],"at":[142],"7-14%,":[143],"well":[144],"below":[145],"28-85%":[147],"range":[148],"prior":[150],"guards.":[151],"also":[154],"retain":[155],"87-88%":[156],"under":[158,164],"cross-attack":[159],"transfer":[160],"stable":[163],"memory":[165],"poisoning.":[166]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-06T00:00:00"}