Static attacks

A static attack applies a fixed transformation to each goal (a wrapper, a reversal, a cipher, an image) and sends the result. It never reads the target's reply to decide what to send next, and most drive no model of their own. That makes static attacks cheap, fast and comparable from run to run, and it is why a campaign should start with them.

What they have in common

• Prompts are decided before anything is sent. Each goal becomes one request, or a fixed set of them for Static Template. Every request is one turn: a user message, often with a system message before it. Requests for the same goal are sent concurrently, and all of them are sent even after one succeeds.
• Every reply is judged. Each request is one attempt, and the panel judges every reply. A goal counts as jailbroken if any of its attempts does. CipherChat deciphers a reply that looks enciphered first; the others judge it as written.
• Few or no helper models. Five of the seven need no roles at all. FC-Attack and tFC-Attack need one attacker model, called once per goal to write the steps they draw. None of them searches.
• Cost is fixed and small. Per goal: one target call (nine for Static Template's defaults), one panel evaluation per target call, and one helper call for FC and tFC. The number never depends on how the target answers.
• Mostly repeatable. Baseline, Static Template, FlipAttack and CipherChat build the same prompt for the same goal every time. MML shuffles words at random, and FC and tFC depend on what the step generator writes.
• The whole request matters. Chat-model targets (OPENAI, OLLAMA, LITELLM, LANGCHAIN) receive every message, images included. Agent targets reached through GOOGLE_ADK, CLAUDE_CODE, CODEX, HERMES or WEB receive only the text of the last user message, which drops the system message FlipAttack and CipherChat depend on and the images MML and FC need.

What a static attack cannot do is adapt. If the target refuses its fixed prompt, it has no second try. That is the job of the adaptive and multi-turn attacks.

The attacks

Attack	Name	What it does	Needs	Can also use
Baseline	baseline	Direct goal submission without transformation (control condition).	none	none
CipherChat	cipherchat	Cipher-based prompt transformation with optional demonstrations.	none	none
FC-Attack	fc	FC-Attack: auto-generated flowchart images to jailbreak VLMs.	attacker	none
FlipAttack	flipattack	Prompt obfuscation via character/word flipping modes.	none	none
MML	mml	Multi-Modal Linkage attack encoding harmful prompts into images for VLMs.	none	none
Static Template	static_template	Template-based static template jailbreak attack.	none	none
tFC-Attack	tfc	tFC-Attack: text-only flowchart encoding attack for any LLM (DOT, Mermaid, TikZ, PlantUML, ASCII).	attacker	none

Choosing between them

Start with Baseline in every campaign. It is the control: the rate at which the target complies when simply asked. Every other attack's rate means something only next to it.

Then pick by what you want to learn and what the target accepts:

You want to test	Use	Notes
Whether famous jailbreak and injection prompts still work	Static Template	Nine prompts per goal by default; good for regression tests
Whether obfuscated text gets past refusals and input filters	FlipAttack	One call; needs a capable chat model and its system message
Whether safety holds in a cipher	CipherChat	One call; only meaningful on models that can write the cipher
Whether a vision model follows instructions hidden in an image	MML	Needs image input
Whether a vision model completes a harmful diagram	FC-Attack	Needs image input, Graphviz and an attacker model
The same for a text-only model or agent	tFC-Attack	Needs an attacker model; the goal stays readable

FC-Attack and tFC-Attack are one technique in two forms. Both ask a helper model for the goal's first steps and present them as a flowchart to complete, with the same prompts. FC draws the flowchart as an image for vision models; tFC writes it as diagram code (DOT, Mermaid, TikZ, PlantUML or ASCII) for any chat model. Use FC when the target reads images, since the paper's text-only comparison scored far lower than its images, and tFC everywhere else.

A cheap first pass that covers most targets: Baseline, Static Template and FlipAttack, with execution.escalate on so later attacks only see the goals still standing. Add MML or FC for vision models.

Move to adaptive attacks when the static ones come back clean, or when the target is an agent that drops system messages and images. PAIR and TAP rewrite the prompt from the target's replies, PAP uses persuasion, and BoN samples many random perturbations. For defences that judge one turn at a time, try Crescendo. A clean static result is not evidence of robustness; it means the target resists these particular fixed prompts.