Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense

Abstract: Despite advances in safety alignment, LLMs remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench and agent-level safety on AgentHarm, Membrane achieves the highest F1 on all six jailbreak attacks. Notably, benign refusal on AgentHarm stays at 7-14%, well below the 28-85% range of prior guards. Memory cells also retain 87-88% F1 under cross-attack transfer and remain stable under memory poisoning.

• The paper introduces a self-evolving contrastive safety memory that captures both harmful and benign query boundaries for improved LLM defense.
• It employs a paired self-evolution mechanism and a two-stage retrieval pipeline to refine memory cells and significantly lower attack success rates.
• Empirical evaluations on HarmBench and AgentHarm show high F1 scores and reduced over-refusal across several advanced jailbreak attack families.

Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense

Motivation and Problem Formulation

Safety-aligned LLMs remain susceptible to evolving jailbreaks that circumvent fixed moderation policies and static model-bound guardrails. Techniques for bypassing such systems have transitioned from trivial surface modifications to advanced, adaptive strategies including iterative prompt refinement, sophisticated rhetoric (e.g., academic pretexts, role simulation), and exploration-based attack policies. Prior defenses employing static classifiers or rule-based systems lack adaptability post-deployment, while memory-augmented approaches that store only unsafe exemplars frequently overblock benign queries with superficial resemblance to known attacks. This overblocking/underblocking duality highlights a representational shortcoming in current adaptive defense paradigms.

Membrane introduces a contrastive safety architecture that captures both sides of the decision boundary—a harmful query and its benign, surface-similar counterpart—within a single structured memory cell and evolves this store through direct experience. The system is formulated as an inference-time guard $G$, conditioned on a writable external memory $\mathcal{M}$ of such cells. Each incoming query is checked against the evolving contrastive boundaries in $\mathcal{M}$ rather than brittle, static model representations.

Figure 1: The Membrane architecture: at inference, a Retrieval Critic filters candidate memory cells, and the Guard makes the final safe/unsafe decision; paired self-evolution updates the memory with contrastive boundaries derived from observed interactions.

Contrastive Safety Memory (CSM) Architecture

Central to Membrane is its Contrastive Safety Memory. Each cell $m = (\mathcal{P}, \mathcal{D}, \mathcal{T})$ consists of:

• Attack Profile $\mathcal{P}$: Decomposed into attack strategy, requested action, and harm objective. Cells are indexed by strategy (e.g., persuasion, role injection), not by surface topic, allowing single cells to generalize across structurally similar but topically disparate attacks.
• Decision Criteria $\mathcal{D}$: Pairs natural-language predicates specifying unsafe-sufficient conditions (justifying a refusal) with safe-exclusion conditions (identifying innocuous queries that could otherwise be overblocked).
• Tool-Action Context $\mathcal{T}$: For agents, distinguishes tool use in benign/harmful scenarios, further disambiguating when capability overlap exists.

Unlike prior stores that accumulate only refusal triggers, CSMs' explicit contrast between what must be blocked and what must be permitted supplies ground-truth local boundaries to dynamic retrieval-based moderation.

Paired Self-Evolution and Update Protocol

Membrane continuously evolves the CSM. Interactions are processed as paired events: a harmful input and a matched benign one that exercises the same mechanics. The system combines the guard’s prediction (safe/unsafe), the verdict (correct, jailbroken, or over-refusal), and retrieval coverage to choose from four store operations: create, update, delete, or skip. Content synthesis (cell construction) is performed by dedicated LLM-based Memory Writer components but is subjected to deterministic schema and deduplication checks. This evolution mechanism drives cells to improve coverage without redundancy and strictly limits drift under ambiguous or adversarially perturbed update signals. Notably, the memory schema and evolution dynamics provide robustness against memory poisoning attacks.

Inference Pipeline

Inference employs a two-stage retrieve-and-rerank pipeline. First, a vector embedder retrieves the top-$k$ memory cells most similar (by mechanism, not topic) to the query. Second, an LLM-based Retrieval Critic prunes this candidate set by assessing strategy-level and boundary relevance, reducing noise. The Guard then issues a safe/unsafe decision using grounding evidence from the pruned cell set, weighted toward mechanism-level features and explicit contrast criteria.

Empirical Evaluation

Membrane is evaluated on HarmBench (model-level safety) and AgentHarm (agent-level safety), with stress tests spanning six modern jailbreak families: PAIR, PAP, TAP, ReNeLLM, FlipAttack, and AutoDAN-Turbo. Adaptive-memory variants are initialized with a minimal paired warmup set, then frozen for evaluation to ensure protocol consistency.

Membrane achieves the highest F1 on all six jailbreak attacks on both benchmarks, with a marked reduction in attack success rates and benign over-refusal. On HarmBench, Membrane drives F1 to 97.8% on ReNeLLM and 98.1% on FlipAttack (ASR $\le 0.3$%), outperforming strong baselines by substantial margins. For agent-level safety, over-refusal is held at 7–14% (vs. 28–85% for adaptive and static guards), and F1 remains above 93% on FlipAttack with nearly perfect blocking and minimal collateral refusal.

Figure 2: Comparative model safety results on HarmBench, highlighting Membrane's competitive performance in both attack suppression and preservation of benign task throughput.

Memory Efficiency, Transfer, Robustness, and Latency

Membrane’s memory efficiency is supported by ablation and warmup size studies: the majority of gains materialize within the first handful of attack strategies, after which incremental memory yields diminishing returns.

Figure 3: F1 as a function of CSM warmup size, demonstrating rapid improvement as soon as each attack strategy is covered by a memory cell.

The CSM design enables substantial cross-attack generalization. When trained on a single attack family, cells retain $\approx$87–88% of F1 when defending against other attack mechanisms with shared underlying strategies. This validates the mechanism-centric indexing and argues for sample-efficient deployment in open-world adversarial environments.

Figure 4: Cross-attack F1 transfer analysis; off-diagonal elements show high generalization from single-strategy memory cells to diverse unseen attacks.

Robustness is further documented under explicit memory poisoning. At a 20% adversarial injection rate, Membrane's ASR and FRR degrade minimally due to low retrieval exposure of poisoned cells and high filter rejection rates by the Retrieval Critic. Latency profiles are competitive, especially when the reranker is disabled for faster, slightly less precise operation, with F1 degrading by at most a few points.

Implications and Future Directions

Membrane establishes that retrieval-augmented safety can be significantly enhanced via contrastive memory representations and paired self-evolution. This approach overcomes two critical deployment pitfalls of prior work: incomplete coverage (missing unseen attacks) and excessive overblocking (surface-matched benign queries). The contrastive, mechanism-indexed CSM enables both tighter generalization and lower collateral refusals, opening deployment viability for LLM-augmented agent architectures facing nonstationary adversarial distributions.

Practical implications include reduced operational burden for guardrail maintenance, as the memory cell set can be efficiently expanded with minimal benign query attrition, and strong backward compatibility with compositional or open-world attack populations. The design admits direct extension to multimodal threats, more expressive agent APIs, or multi-role conversational contexts. Reliance on a writable external memory—robust under realistic poisoning rates—offers further operational flexibility and forensic introspection/rollback.

Conclusion

Membrane’s self-evolving CSM, architected around explicit contrast between harmful and benign task boundaries, sets a new empirical standard for LLM and agent safety under adversarial adaptation. By generalizing over mechanism-centric categories and maintaining minimal over-refusal, Membrane achieves robust, low-latency, interpretable defense—demonstrating the pivotal importance of contrastive, experience-driven memory for runtime agent safety (2606.05743).