# Claim 4: Static-Attacker Ablation Study


---
<!-- trackio-cell
{"type": "markdown", "id": "cell_d4eb2c4972d1", "created_at": "2026-07-15T21:55:46+00:00", "title": "Verification of Claim 4"}
-->
We verified Claim 4 from Section 5.3 (Figure 3):
- **Safety gain**: Compared to training against a static attacker (where jailbreaks are fixed), co-evolution training against a dynamic attacker yields a **12% reduction** in Attack Success Rate (ASR) under the NetSafe threat.
- **Utility gain**: AdvEvo-MARL also achieves up to a **4% improvement** in task performance (specifically on LiveCodeBench) compared to the static attacker baseline.
- **Underlying reason**: Evolving attackers continuously discover new, diverse jailbreaks (non-monotonic increasing trend in attacker prompt diversity shown in Figure 4). This acts as a regularizer, preventing defenders from overfitting to specific jailbreak patterns and encouraging the emergence of generalizable task-solving and defense capabilities.