DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection

2026-07-22

AI Summary

Current safety evaluations and defenses for large language models (LLMs) predominantly rely on static approaches, which struggle to counter continuously evolving adversarial attacks. This work proposes DARWIN, a novel framework that introduces open-ended evolutionary mechanisms into LLM safety for the first time, enhancing robustness through co-evolving attack and defense strategies. DARWIN-Attack dynamically generates high-success jailbreaking prompts by integrating strategy discovery, mutation, selection, and feedback, while DARWIN-Guard performs online adversarial training using emerging adversarial examples. The framework maintains near-perfect (>99%) performance on benign tasks and achieves an average unsafe recall rate of 91.6% across twelve safety benchmarks. Experiments demonstrate that DARWIN attains over 90% attack success rates against state-of-the-art models such as GPT-5.5, substantially surpassing the limitations of static defense paradigms.

Abstract

Most existing LLM safety evaluation and defense methods follow a static formulation: jailbreak vulnerabilities are evaluated with fixed attack methods, and guardrails are trained on fixed malicious prompt datasets. However, real-world adversaries continuously evolve their capabilities and expand the attack space. To address this challenge, we propose DARWIN, an evolutionary attack-defense framework that formulates jailbreaking as an open-ended evolution process and continuously updates guardrails through an evolving attack-defense loop. DARWIN-Attack is an evolutionary adversary that expands its capabilities through strategy discovery, mutation, selection, and feedback-driven composition. It collects strategies from broad external sources, generates new variants through self-reflection and genetic evolution, and retains effective strategies based on their performance against aligned LLMs. During attack execution, DARWIN-Attack adaptively selects and combines evolved strategies according to feedback from target LLMs and guardrails. Across frontier models and guardrails, it achieves state-of-the-art attack success rates, including nearly 100% on DeepSeek-V4-Pro and YuFeng-XGuard and over 90% on GPT-5.5. On the defense side, we introduce DARWIN-Guard, an online adversarial training paradigm that iteratively learns from emerging adversarial samples generated by DARWIN-Attack. To improve robustness without sacrificing utility, DARWIN-Guard jointly trains on malicious and benign disguised queries, encouraging the model to identify underlying intent rather than superficial attack patterns. DARWIN-Guard achieves an average unsafe recall of 91.6% across 12 safety benchmarks, outperforming strong guardrails such as YuFeng-XGuard and Nemotron Guard, while maintaining a nearly 100% pass rate on standard benign datasets.

Problem

• LLM safety
• jailbreak attacks
• adversarial evolution
• guardrail robustness
• dynamic defense

Innovation

• evolutionary attack
• adaptive defense
• online adversarial training
• jailbreak strategies
• intent-aware guardrail