@inproceedings{wang-etal-2025-stand-shoulders,
    title = "Stand on The Shoulders of Giants: Building {J}ail{E}xpert from Previous Attack Experience",
    author = "Wang, Xi  and
      Jian, Songlei  and
      Li, Shasha  and
      Li, Xiaopeng  and
      Ji, Bin  and
      Jun, Ma  and
      Liu, Xiaodong  and
      Wang, Jing  and
      Zhang, Jianfeng  and
      Yu, Jie  and
      Bao, Feilong  and
      Wangbaosheng",
    editor = "Christodoulopoulos, Christos  and
      Chakraborty, Tanmoy  and
      Rose, Carolyn  and
      Peng, Violet",
    booktitle = "Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing",
    month = nov,
    year = "2025",
    address = "Suzhou, China",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-emnlp/2025.emnlp-main.190/",
    pages = "3826--3843",
    ISBN = "979-8-89176-332-6",
    abstract = "Large language models (LLMs) generate human-aligned content under certain safety constraints. However, the current known technique ``jailbreak prompt'' can circumvent safety-aligned measures and induce LLMs to output malicious content. Research on Jailbreaking can help identify vulnerabilities in LLMs and guide the development of robust security frameworks. To circumvent the issue of attack templates becoming obsolete as models evolve, existing methods adopt iterative mutation and dynamic optimization to facilitate more automated jailbreak attacks. However, these methods face two challenges: inefficiency and repetitive optimization, as they overlook the value of past attack experiences. To better integrate past attack experiences to assist current jailbreak attempts, we propose the $\textbf{JailExpert}$, an automated jailbreak framework, which is the first to achieve a formal representation of experience structure, group experiences based on semantic drift, and support the dynamic updating of the experience pool. Extensive experiments demonstrate that JailExpert significantly improves both attack effectiveness and efficiency. Compared to the current state-of-the-art black-box jailbreak method, JailExpert achieves an average increase of 24{\%} in attack success rate and 2.7 times improvement in attack efficiency."
}