Self-Evolving Defense：LLM智能体安全框架

该框架在DeepSeek V4 Flash、GLM 5.2和Kimi K3三个开源模型上测试，在AGENTDOJO基准上将目标提示注入成功率降至0.

42%，而最佳基线防御为3.7%。

在HARMBENCH基准上，SED将X-TEAMING攻击成功率控制在7.8%，远低于最佳基线的35.

2%，同时保持良性任务效用。

Self-Evolving Defense: Continual Security Policy Learning for LLM Agents

Large language models (LLMs) increasingly power agents that access sensitive information, use external tools, and modify software repositories. Although these capabilities offer substantial benefits, they also create security risks such as jailbreaks, prompt injection, and vulnerable code generation. Existing defenses often require retraining, fail to adapt to evolving attacks, or address only a single threat pattern. To address these limitations, we propose Self-Evolving Defense (SED), a training-free framework that distills harmful agent trajectories into reusable security policies without updating model weights. By retrieving relevant policies for future tasks, SED continually adapts to new attacks while retaining knowledge across attack scenarios. To evaluate the effectiveness of SED, we test it with three open-source models (DeepSeek V4 Flash, GLM 5.2, and Kimi K3) on eight benchmarks that span jailbreaks, prompt injection, and insecure code generation. SED lowers targeted prompt-injection success on AGENTDOJO to 0.42%, compared with 3.7% for the best baseline defense, and holds adaptive X-TEAMING attack success on HARMBENCH to 7.8%, more than four times lower than the best baseline at 35.2%, while preserving benign task utility.

本条情报归属 AITOP「论文」核心栏目，重点聚焦中国 AI 产业与国产大模型生态。在跨区域产业观察坐标中，该动态直接关联「AI 开发者工具链、Coding Agent 与工程化实践」「各国 AI 监管法案、合规治理与主权算力政策」研究主线，反映出当前技术演进与商业落地的最新风向。涉及核心实体与技术议题包括：Self-Evolving Defense、DeepSeek V4 Flash、GLM 5.2、Kimi K3，读者可通过下方标签进入对应专题页查阅历史脉络与关联对比。

信源核验说明：本文原始信息发布自一手权威信源「arXiv: DeepSeek」（Tier-1 一手发布），具备高确定性参考价值。截至目前，全网已有 8 家独立信源对该事件进行交叉印证与跟进报道（含 IT之家、Xianbao Qian、Cline 等），属于近期高关注度行业信号。