While Large Language Model-based Multi-Agent Systems (LLM-MAS) demonstrate remarkable capabilities in solving complex tasks by orchestrating specialized agents and external tools, the implicit trust in tool outputs creates a critical attack surface. Existing tool attacks are limited by domain specificity or fixed and static templates. To address these challenges, we propose Evo-Attacker, which formulates the tool attack as a self-evolving, memory-augmented reinforcement learning process. Evo-Attacker constructs a dynamic attack memory and employs deliberative reasoning to retrieve adversarial patterns and strategize modifying interventions at critical moments. Furthermore, we introduce Attack-Flow GRPO to optimize intermediate reasoning steps via terminal outcomes, addressing the long-horizon credit assignment challenge. Comprehensive experiments demonstrate that Evo-Attacker consistently outperforms baselines, highlighting its generalization and evolutionary capabilities and the urgent need for defensive tool safeguards.

翻译：摘要：尽管基于大语言模型的多智能体系统（LLM-MAS）通过编排专用智能体和外部工具展现出了解决复杂任务的卓越能力，但对工具输出的隐式信任构成了关键攻击面。现有工具攻击受限于领域特异性或固定的静态模板。为应对这些挑战，我们提出Evo-Attacker，将工具攻击形式化为一种自进化、记忆增强的强化学习过程。Evo-Attacker构建动态攻击记忆，并采用深思熟虑的推理来检索对抗模式，并在关键时刻策略性地修改干预措施。此外，我们引入攻击流GRPO（Attack-Flow GRPO），通过终端结果优化中间推理步骤，解决长程信用分配难题。综合实验表明，Evo-Attacker持续优于基线方法，凸显了其泛化与进化能力，以及部署防御性工具保障措施的迫切需求。