DARWIN: Evolving LLM Jailbreak Framework

A new framework called DARWIN uses a genetic algorithm to evolve jailbreak prompts for large language models, achieving nearly 100% success rates on DeepSeek-V4-Pro and over 90% on GPT-5.5. The DARWIN-Guard defense employs online adversarial training on both malicious and benign disguised queries to counter such attacks, maintaining a 91.6% unsafe recall and nearly 100% benign pass rate across 12 benchmarks.

DARWIN: Evolving LLM Jailbreak Framework The DARWIN-Attack side works like a genetic algorithm for prompt engineering. It doesn't just rely on one "magic prompt"; it pulls strategies from external sources and then uses self-reflection and mutation to create new variants. It's essentially a feedback-driven loop: it tries a strategy, sees if the LLM bites, and then evolves the prompt further based on the failure or success. The results are pretty wild—hitting nearly 100% success rates on models like DeepSeek-V4-Pro and over 90% on GPT-5.5. To counter this, DARWIN-Guard uses online adversarial training. Instead of a one-time training session, it iteratively learns from the samples generated by the evolutionary attacker. A key detail here is that it trains on both malicious and "benign disguised" queries. This stops the guardrail from becoming a blunt instrument that blocks everything; it forces the model to recognize the actual intent rather than just flagging a specific phrase or pattern. For anyone doing a deep dive into LLM agents or red-teaming, this evolutionary approach is way more realistic than standard benchmarks. It shows that the only way to actually secure a model is to have a defense that evolves as fast as the attack. Unsafe Recall: 91.6% across 12 benchmarks Benign Pass Rate: Nearly 100% Attack Performance: 90% on frontier models Next OpenAI vs Hugging Face: The Accidental Breach → /en/threads/2274/