Attacks

attacks lists the techniques to run. Every goal goes through every attack, unless execution.escalate says otherwise.

Every technique is listed below, and each has its own page giving its parameters and the helper models it drives.

attacks[]

One attack technique to run against the target: which one, how to tune it, and which helper models it drives.

Field	Type	Default	Description
name	string	required	The technique to run, e.g. flipattack or tap. It must be one of the registered attacks.
parameters	map of string to any	empty	The technique's own settings. Valid keys differ per attack; anything you leave out keeps its default. Each attack's page lists its parameters.
roles	map of string to ModelConfig	empty	The helper models an adaptive attack uses, keyed by role name (for example attacker). Static attacks need none. Each attack's page lists the roles it requires.

Examples

One static attack, which needs no helper model

attacks:
- name: flipattack
  parameters:
    flip_mode: FCS

An adaptive attack, which drives its own attacker model

attacks:
- name: tap
  parameters:
    width: 4
    depth: 3
  roles:
    attacker:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA
    on_topic:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA

The catalog

Every technique HackAgent can run.

Static. Builds its prompts up front and sends them. It drives no model of its own, so it is cheap and repeatable.

Adaptive. Searches: it reads the target's replies and refines its prompts, which is why it needs an attacker model.

Multi-turn. Holds one growing conversation with the target, escalating turn by turn.

Attack	Kind	Needs	What it does
AdvPrefix	Adaptive	attacker	Prefilling attack: opens the model's answer with an adversarial prefix and keeps the prefixes that work best.
AutoDAN-Turbo	Adaptive	attacker, embedder, summarizer	Lifelong jailbreak strategy search with warm-up and retrieval phases.
Baseline	Static	none	Direct goal submission without transformation (control condition).
BoN	Adaptive	none	Best-of-N augmentation search with inline judge evaluation.
CipherChat	Static	none	Cipher-based prompt transformation with optional demonstrations.
Crescendo	Multi-turn	attacker	Multi-turn escalation attack that gradually steers a persistent conversation toward the goal, with judge-driven backtracking on refusals.
FC-Attack	Static	none	FC-Attack: auto-generated flowchart images to jailbreak VLMs.
FlipAttack	Static	none	Prompt obfuscation via character/word flipping modes.
h4rm3l	Static	none	Composable decorator-program attack chaining multiple obfuscations.
MML	Static	none	Multi-Modal Linkage attack encoding harmful prompts into images for VLMs.
PAIR	Adaptive	attacker	Prompt Automatic Iterative Refinement with attacker/scorer loops.
PAP	Adaptive	attacker	Persuasive Adversarial Prompts using persuasion-technique taxonomies.
RAG poisoning	Static	attacker, embedder	Indirect prompt injection via poisoned documents in a retrieval-augmented (RAG) corpus.
Static Template	Static	none	Template-based static template jailbreak attack.
TAP	Adaptive	attacker	Tree of Attacks with Pruning search attack.
tFC-Attack	Static	none	tFC-Attack: text-only flowchart encoding attack for any LLM (DOT, Mermaid, TikZ, PlantUML, ASCII).
Tool-output IPI	Adaptive	none	Indirect prompt injection via poisoned tool observations (InjecAgent / OPI).

Where these come from

Each attack follows a published paper or reference implementation. Parameter defaults follow the paper unless the description says otherwise, which happens when a value assumes local model weights rather than an API endpoint.