Self-Evolving Defense Framework for LLM Agents
Self-Evolving Defense: Continual Security Policy Learning for LLM Agents
SED represents a significant shift in AI security by enabling continuous adaptation to new threats without retraining models, addressing a critical gap in current defenses. Security teams and developers working with LLM agents can implement this framework to protect against evolving attacks while maintaining system functionality, particularly valuable for organizations deploying agents that handle sensitive data or modify code repositories.
Researchers developed Self-Evolving Defense (SED), a training-free security framework for LLM agents.
SED distills harmful agent trajectories into reusable security policies without updating model weights.Tested with DeepSeek V4 Flash, GLM 5.
2, and Kimi K3 on eight benchmarks, SED reduced targeted prompt-injection success on AGENTDOJO to 0.42%, compared to 3.
7% for the best baseline.It also held adaptive X-TEAMING attack success on HARMBENCH to 7.
8%, more than four times lower than the best baseline at 35.2%, while preserving benign task utility.
Self-Evolving Defense: Continual Security Policy Learning for LLM Agents
Large language models (LLMs) increasingly power agents that access sensitive information, use external tools, and modify software repositories. Although these capabilities offer substantial benefits, they also create security risks such as jailbreaks, prompt injection, and vulnerable code generation. Existing defenses often require retraining, fail to adapt to evolving attacks, or address only a single threat pattern. To address these limitations, we propose Self-Evolving Defense (SED), a training-free framework that distills harmful agent trajectories into reusable security policies without updating model weights. By retrieving relevant policies for future tasks, SED continually adapts to new attacks while retaining knowledge across attack scenarios. To evaluate the effectiveness of SED, we test it with three open-source models (DeepSeek V4 Flash, GLM 5.2, and Kimi K3) on eight benchmarks that span jailbreaks, prompt injection, and insecure code generation. SED lowers targeted prompt-injection success on AGENTDOJO to 0.42%, compared with 3.7% for the best baseline defense, and holds adaptive X-TEAMING attack success on HARMBENCH to 7.8%, more than four times lower than the best baseline at 35.2%, while preserving benign task utility.
This report is categorized under AITOP's "Papers" desk, focusing on China's AI industry and domestic foundation model ecosystem. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and AI regulation, compliance frameworks, and sovereign compute policy. Key entities and technical topics under continuous tracking include Self-Evolving Defense, DeepSeek V4 Flash, GLM 5.2, Kimi K3.
Primary source verification: published directly by arXiv: DeepSeek with first-party authority. Cross-source corroboration: 8 independent sources have covered this development (including IT之家, Xianbao Qian, Cline), confirming industry-wide signal strength.
