mlsanityData to 14 Oct 2026

ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs

arXiv 2511.02356 ↗First posted 4 Nov 2025cs.CR cs.LGcited by 1

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Despite extensive safety alignment, Large Language Models (LLMs) remain vulnerable to jailbreak attacks. However, existing methods generally lack the capability for continuous learning and self-evolution from interactions, limiting the diversity and adaptability of attack strategies. To address this, we propose ASTRA, an automated framework capable of autonomously discovering, retrieving, and evolving attack strategies. ASTRA operates on a closed-loop ``attack-evaluate-distill-reuse'' mechanism, which not only generates attack prompts but also automatically distills reusable strategies from every interaction. To systematically manage these strategies, we introduce a dynamic three-tier strategy library (Effective, Promising, and Ineffective) that categorizes strategies based on performance. This hierarchical memory mechanism enables the framework to enhance efficiency by leveraging successful patterns while optimizing the exploration space by avoiding known failures. Extensive experiments in a black-box setting demonstrate that ASTRA significantly outperforms existing baselines.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 34 of its 55 references that are in the map. First posted on arXiv 4 Nov 2025.

Builds on

34 of 55 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  2. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  4. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 29

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  4. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  7. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  8. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  10. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  11. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  12. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
17 more
  1. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  2. 2023Principle-Driven Self-Alignment of Language Models from Scratch with Minimal Human Supervisioncited by 318
  3. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  4. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  5. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  6. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 151
  7. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 95
  8. 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinkingcited by 81
  9. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 80
  10. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 76
  11. 2025The Alternative Annotator Test for LLM-as-a-Judge: How to Statistically Justify Replacing Human Annotators with LLMscited by 74
  12. 2024PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensemblescited by 57
  13. 2024Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characterscited by 42
  14. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 37
  15. 2025from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphorscited by 15
  16. 2024Jailbreaking? One Step Is Enough!cited by 9
  17. 2025TurboFuzzLLM: Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practicecited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Breadcrumbing Search Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space
  2. 2026Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking
  3. 2026A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks
  4. 2025Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experience
  5. 2025MAJIC: Markovian Adaptive Jailbreaking via Iterative Composition of Diverse Innovative Strategies
  6. 2026SRTJ: Self-Evolving Rule-Driven Training-Free LLM Jailbreaking
  7. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
  8. 2024Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models