---
title: "SafetyMem — paper by Wang et al. (2026) — summary and ideas"
description: "An adversarial expansion step creates harder variants of prompts that were already blocked, which helps expose blind spots. 34 references."
authors: ["Hao Wang", "Ziyi Ni", "Huacan Wang", "Pin Lyu", "Lei Sha"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1168/"
doi: "10.18653/v1/2026.acl-long.1168"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wang-2026-safetymem-adaptive-jailbreak-defense-dual/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wang-2026-safetymem-adaptive-jailbreak-defense-dual/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/48/) / SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory

# SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory

**Authors:** [Hao Wang](https://md.research.elamur.ai/free/en/authors/hao-wang/), [Ziyi Ni](https://md.research.elamur.ai/free/en/authors/ziyi-ni/), [Huacan Wang](https://md.research.elamur.ai/free/en/authors/huacan-wang/), Pin Lyu and [Lei Sha](https://md.research.elamur.ai/free/en/authors/lei-sha/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1168/) · [PDF](https://aclanthology.org/2026.acl-long.1168.pdf) · [DOI 10.18653/v1/2026.acl-long.1168](https://doi.org/10.18653/v1/2026.acl-long.1168) · [OpenAlex](https://openalex.org/W7166802255)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
LLM jailbreak defenses tend to fall into two camps. Methods that change model weights, such as fine-tuning or trained detectors, are costly and slow to adapt. Inference-time filters are flexible, but they start from scratch on every prompt. SafetyMem is a training-free framework that lets a model accumulate defense experience in an external, two-part memory. Semantic Safety Memory (SSM) groups jailbreak prompts into typed attack-pattern nodes with example cases, and retrieves them by embedding similarity. Episodic Safety Memory (ESM) holds structured defense rules. An LLM reflector rewrites or extends these rules whenever a classification goes wrong, repeating the update until the failed case is handled correctly. An adversarial expansion step creates harder variants of prompts that were already blocked, which helps expose blind spots. At inference time, matched patterns and rules jointly guide the model's decision. The authors report lower attack success and over-refusal than baselines such as G4D across several open and proprietary LLMs. Memory built with strong models can also be transferred to lightweight edge models.

## Key points
- Evaluation covers HarmBench, AdvBench and a dataset of stealthy jailbreak prompts, with over-refusal measured on OR-Bench. Backbones include LLaMA3-8B, Qwen2.5-7B, Vicuna-7B, DeepSeek-V3, GPT-3.5 and GPT-4o.
- On OR-Bench with Qwen2.5-7B, SafetyMem lowers the refusal rate on benign prompts to 34.6%, compared with 45.2% for G4D. It has the lowest refusal rate on every model tested.
- In the ablation study, removing ESM causes the largest degradation, with ASR rising above 22% on GPT-4o. Removing SSM raises both ASR and FPR, and dropping expansion weakens robustness.
- Each ESM rule is a tuple of name, defense rationale, objectives and actions. Each SSM node stores an attack_type, an explanation and a list of attack cases.
- The authors release their SSM and ESM repositories. They caution that memory quality depends on how diverse the construction data is, and recommend checking target datasets before reuse.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Beihang University](https://md.research.elamur.ai/free/en/universities/beihang-university/) — University, Beijing, China · 86 works · 9,097 citations
- [University of Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/universities/university-of-chinese-academy-of-sciences/) — University, Beijing, China · 188 works · 8,743 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Hao Wang, Ziyi Ni, Huacan Wang, Pin Lyu and Lei Sha. 2026. SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wang2026safetymem,
  title = {{SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory}},
  author = {Hao Wang, Ziyi Ni, Huacan Wang, Pin Lyu and Lei Sha},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1168},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1168}
}
```

- [← previous SafeSteer: A Decoding-level Defense Mechanism for Multimodal Large Language Models](https://md.research.elamur.ai/free/en/papers/zeng-2026-safesteer-decoding-level-defense-mechanism/)
- [next → SagaQA: A Multi-hop Reasoning Benchmark for Long-form Narrative Understanding in TV Series](https://md.research.elamur.ai/free/en/papers/pennec-2026-sagaqa-multi-hop-reasoning-benchmark/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/48/)

## References

34 references, 24 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774.
2. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. [Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions](https://md.research.elamur.ai/free/en/papers/bianchi-2023-safety-tuned-llamas-lessons-improving/). arXiv preprint arXiv:2309.07875.
3. He Cao, Weidi Luo, Yu Wang, Zijing Liu, Bing Feng, Yuan Yao, and Yu Li. 2024. Guide for defense (g4d): Dynamic guidance for robust and balanced defense in large language models. arXiv preprint arXiv:2410.17922. — [arXiv:2410.17922](https://arxiv.org/abs/2410.17922) [find](https://scholar.google.com/scholar?q=He+Cao%2C+Weidi+Luo%2C+Yu+Wang%2C+Zijing+Liu%2C+Bing+Feng%2C+Yuan+Yao%2C+and+Yu+Li%2E+2024%2E+Guide+for+defense+%28g4d%29%3A+Dynamic+guidance+for+robust+and+balanced+defense+in+large+language+models%2E+arXiv+preprint+arXiv%3A2)
4. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
5. Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. [Or-bench: An over-refusal benchmark for large language models](https://md.research.elamur.ai/free/en/papers/cui-2024-bench-over-refusal-benchmark-large/). arXiv preprint arXiv:2405.20947.
6. Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. Attacks, defenses and evaluations for llm conversation safety: A survey. arXiv preprint arXiv:2402.09283. [find](https://scholar.google.com/scholar?q=Zhichen+Dong%2C+Zhanhui+Zhou%2C+Chao+Yang%2C+Jing+Shao%2C+and+Yu+Qiao%2E+2024%2E+Attacks%2C+defenses+and+evaluations+for+llm+conversation+safety%3A+A+survey%2E+arXiv+preprint+arXiv%3A2402%2E09283%2E)
7. Melody Y Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Heylar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, and 1 others. 2024. [Deliberative alignment: Reasoning enables safer language models](https://md.research.elamur.ai/free/en/papers/guan-2024-deliberative-alignment-reasoning-enables-safer/). arXiv preprint arXiv:2412.16339.
8. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
9. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
10. Jiaming Ji, Boyuan Chen, Hantao Lou, Donghai Hong, Borong Zhang, Xuehai Pan, Juntao Dai, Tianyi Qiu, and Yaodong Yang. 2024. [Aligner: Efficient alignment by learning to correct](https://md.research.elamur.ai/free/en/papers/ji-2024-aligner-efficient-alignment-learning-correct/). arXiv preprint arXiv:2402.02416.
11. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and 1 others. 2024. [Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models](https://md.research.elamur.ai/free/en/papers/jiang-2024-wildteaming-scale-wild-jailbreaks-adversarially/). arXiv preprint arXiv:2406.18510. of the 2024…
12. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023. [Deepinception: Hypnotize large language model to be jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/). arXiv preprint arXiv:2311.03191.
13. Hao Wang, Hao Li, Junda Zhu, Xinyuan Wang, Chengwei Pan, MinLie Huang, and Lei Sha. 2024b. Diffu-sionattacker: Diffusion-driven prompt manipulation for llm jailbreak. arXiv preprint arXiv:2412.17522. — [arXiv:2412.17522](https://arxiv.org/abs/2412.17522) [find](https://scholar.google.com/scholar?q=Hao+Wang%2C+Hao+Li%2C+Junda+Zhu%2C+Xinyuan+Wang%2C+Chengwei+Pan%2C+MinLie+Huang%2C+and+Lei+Sha%2E+2024b%2E+Diffu%2Dsionattacker%3A+Diffusion%2Ddriven+prompt+manipulation+for+llm+jailbreak%2E+arXiv+preprint+arXiv%3A2412%2E17522%2E+)
14. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
15. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36.
16. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. [Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks](https://md.research.elamur.ai/free/en/papers/luo-2024-jailbreakv-benchmark-assessing-robustness-multimodal/). arXiv preprint arXiv:2404.03027.
17. Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023. [Jailbreak and guard aligned language models with only few in-context demonstrations](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/). arXiv preprint arXiv:2310.06387.
18. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249.
19. Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12):1486–1496. [find](https://scholar.google.com/scholar?q=Yueqi+Xie%2C+Jingwei+Yi%2C+Jiawei+Shao%2C+Justin+Curl%2C+Lingjuan+Lyu%2C+Qifeng+Chen%2C+Xing+Xie%2C+and+Fangzhao+Wu%2E+2023%2E+Defending+chatgpt+against+jailbreak+attack+via+self%2Dreminders%2E+Nature+Machine+Intelligence%2C)
20. Mansi Phute, Alec Helbling, Matthew Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. [Llm self defense: By self examination, llms know they are being tricked](https://md.research.elamur.ai/free/en/papers/phute-2023-llm-self-defense-self-examination/). arXiv preprint arXiv:2308.07308.
21. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) arXiv preprint arXiv:2310.03693.
22. Chengwei Qin, Aston Zhang, Zhuosheng Zhang, Jiaao Chen, Michihiro Yasunaga, and Diyi Yang. 2023. [Is chatgpt a general-purpose natural language processing task solver?](https://md.research.elamur.ai/free/en/papers/qin-2023-chatgpt-general-purpose-natural-language/) arXiv preprint arXiv:2302.06476.
23. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. [Smoothllm: Defending large language models against jailbreaking attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/). arXiv preprint arXiv:2310.03684.
24. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. [" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685.
25. Shengye Wan, Cyrus Nikolaidis, Daniel Song, David Molnar, James Crnkovich, Jayson Grace, Manish Bhatt, Sahana Chennabasappa, Spencer Whitman, Stephanie Ding, and 1 others. 2024. Cyberseceval 3: Advancing the evaluation of cybersecurity risks and capabilities in large language models. arXiv preprint… — [arXiv:2408.01605](https://arxiv.org/abs/2408.01605) [find](https://scholar.google.com/scholar?q=Shengye+Wan%2C+Cyrus+Nikolaidis%2C+Daniel+Song%2C+David+Molnar%2C+James+Crnkovich%2C+Jayson+Grace%2C+Manish+Bhatt%2C+Sahana+Chennabasappa%2C+Spencer+Whitman%2C+Stephanie+Ding%2C+and+1+others%2E+2024%2E+Cyberseceval+3%3A+Advanc)
26. Hao Wang, Hao Li, Minlie Huang, and Lei Sha. 2024a. Asetf: A novel method for jailbreak attack on llms through translate suffix embeddings. In Proceedings Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak atta… [find](https://scholar.google.com/scholar?q=Hao+Wang%2C+Hao+Li%2C+Minlie+Huang%2C+and+Lei+Sha%2E+2024a%2E+Asetf%3A+A+novel+method+for+jailbreak+attack+on+llms+through+translate+suffix+embeddings%2E+In+Proceedings+Zhangchen+Xu%2C+Fengqing+Jiang%2C+Luyao+Niu%2C+Jiny)
27. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. [Jailbreak attacks and defenses against large language models: A survey](https://md.research.elamur.ai/free/en/papers/yi-2024-jailbreak-attacks-defenses-against-large/). arXiv preprint arXiv:2407.04295.
28. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. [Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher](https://md.research.elamur.ai/free/en/papers/yuan-2023-gpt-4-too-smart-safe/). arXiv preprint arXiv:2308.06463.
29. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, and 1 others. 2024a. Shieldgemma: Generative ai content moderation based on gemma. arXiv preprint arXiv:2407.21772. — [arXiv:2407.21772](https://arxiv.org/abs/2407.21772) [find](https://scholar.google.com/scholar?q=Wenjun+Zeng%2C+Yuchi+Liu%2C+Ryan+Mullins%2C+Ludovic+Peran%2C+Joe+Fernandez%2C+Hamza+Harkous%2C+Karthik+Narasimhan%2C+Drew+Proud%2C+Piyush+Kumar%2C+Bhaktipriya+Radharapu%2C+and+1+others%2E+2024a%2E+Shieldgemma%3A+Generative+ai+)
30. Yifan Zeng, Yiran Wu, Xiao Zhang, Huazheng Wang, and Qingyun Wu. 2024b. Autodefense: Multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783. — [arXiv:2403.04783](https://arxiv.org/abs/2403.04783) [find](https://scholar.google.com/scholar?q=Yifan+Zeng%2C+Yiran+Wu%2C+Xiao+Zhang%2C+Huazheng+Wang%2C+and+Qingyun+Wu%2E+2024b%2E+Autodefense%3A+Multi%2Dagent+llm+defense+against+jailbreak+attacks%2E+arXiv+preprint+arXiv%3A2403%2E04783%2E+%E2%80%94+%5BarXiv%3A2403%2E04783%5D%28https%3A%2F%2Far)
31. Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. 2024a. Intention analysis prompting makes large language models a good jailbreak defender. arXiv preprint arXiv:2401.06561. — [arXiv:2401.06561](https://arxiv.org/abs/2401.06561) [find](https://scholar.google.com/scholar?q=Yuqi+Zhang%2C+Liang+Ding%2C+Lefei+Zhang%2C+and+Dacheng+Tao%2E+2024a%2E+Intention+analysis+prompting+makes+large+language+models+a+good+jailbreak+defender%2E+arXiv+preprint+arXiv%3A2401%2E06561%2E+%E2%80%94+%5BarXiv%3A2401%2E06561%5D%28h)
32. Zhexin Zhang, Yida Lu, Jingyuan Ma, Di Zhang, Rui Li, Pei Ke, Hao Sun, Lei Sha, Zhifang Sui, Hongning Wang, and 1 others. 2024b. Shieldlm: Empowering llms as aligned, customizable and explainable safety detectors. arXiv preprint arXiv:2402.16444. [find](https://scholar.google.com/scholar?q=Zhexin+Zhang%2C+Yida+Lu%2C+Jingyuan+Ma%2C+Di+Zhang%2C+Rui+Li%2C+Pei+Ke%2C+Hao+Sun%2C+Lei+Sha%2C+Zhifang+Sui%2C+Hongning+Wang%2C+and+1+others%2E+2024b%2E+Shieldlm%3A+Empowering+llms+as+aligned%2C+customizable+and+explainable+safe)
33. Zhexin Zhang, Junxiao Yang, Pei Ke, Fei Mi, Hongning Wang, and Minlie Huang. 2023. [Defending large language models against jailbreaking attacks through goal prioritization](https://md.research.elamur.ai/free/en/papers/zhang-2024-defending-large-language-models-against/). arXiv preprint arXiv:2311.09096.
34. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.

*Updated 2 November 2026*