Despite advances in safety alignment, large language models remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench and agent-level safety on AgentHarm, Membrane achieves the highest F1 on all six jailbreak attacks. Notably, benign refusal on AgentHarm stays at 7-14%, well below the 28-85% range of prior guards. Memory cells also retain 87-88% F1 under cross-attack transfer and remain stable under memory poisoning.

翻译：尽管在安全对齐方面取得了进展，大语言模型仍然容易受到持续演化的越狱攻击。现有的微调安全分类器无法适应这些不断演化的攻击，而基于自适应记忆的防护栏则倾向于过度拒绝与已存储攻击相似的良性查询。我们提出膜，一种构建于对比安全记忆体之上的自我演化防护栏：每个单元将阻止有害查询的条件与允许表面上相似的良性请求的条件配对。无需重新训练，膜通过将每次有害交互及其良性对应物蒸馏成一个由底层攻击策略索引的对比单元来演化CSM，使得单个单元能够泛化到同一机制的不同主题变体。在推理时，检索到的单元作为精准安全决策的上下文基础。在HarmBench上的模型级安全和AgentHarm上的智能体级安全测试中，膜在所有六种越狱攻击上取得了最高的F1分数。值得注意的是，在AgentHarm上良性拒绝率保持在7-14%，远低于先前防护栏28-85%的范围。在跨攻击迁移下，记忆单元仍保持87-88%的F1分数，并在记忆投毒下保持稳定。