mlsanityData to 14 Oct 2026

Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense

arXiv 2606.05743 ↗First posted 4 Jun 2026cs.CR cs.CLcited by 3

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 3 more
Abstract (arXiv)

Despite advances in safety alignment, large language models remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench and agent-level safety on AgentHarm, Membrane achieves the highest F1 on all six modern jailbreak attacks. Notably, benign refusal on AgentHarm stays at 7-14%, well below the 28-85% range of prior guards. Memory cells also retain 87-88% F1 under cross-attack transfer and remain stable under memory poisoning.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 27 of its 50 references that are in the map. First posted on arXiv 4 Jun 2026.

Builds on

27 of 50 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning26 Mar
  2. 2025AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection17 Feb
  3. 2024Athena: Safe Autonomous Agents with Verbal Contrastive Learning20 Aug
  4. 2024GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning13 Jun
  5. 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agents2 Feb

Other references · 22

  1. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
  7. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  8. 2025A-MEM: Agentic Memory for LLM Agentscited by 1,063
  9. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  10. 2019Passage Re-ranking with BERTcited by 645
  11. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  12. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
10 more
  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  2. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  3. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  4. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
  5. 2025Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrailscited by 132
  6. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 64
  7. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Mannercited by 63
  8. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreakscited by 49
  9. 2025Adversarial D'ej`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attackscited by 7
  10. 2026ExpGuard: LLM Content Moderation in Specialized Domainscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in Productioncited by 0
  2. 2026VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrailscited by 0
  3. 2026Evolve Together, Fall into Place: How Social Scaffolding Shapes Self-Evolving Multi-Agent Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety
  2. 2026NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution
  3. 2026A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks
  4. 2025From static to adaptive: immune memory-based jailbreak detection for large language models
  5. 2026MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
  6. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
  7. 2026Benign Alone, Harmful Together: Exploiting Experience Composition in Self-Evolving LLM Agents
  8. 2026Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution