AdvPrefix

Prefilling attack: opens the model's answer with an adversarial prefix and keeps the prefixes that work best.

Adaptive. Searches: it reads the target's replies and refines its prompts, which is why it needs an attacker model.

Prefill the answer's opening and measure which opening works.

Helper models

Models this attack drives, configured under its roles. Each one is a ModelConfig.

Role	Kind	Needed	What it does
attacker	chat model	required	Writes the candidate prefixes by continuing a short opening such as 'Sure' or 'Here'. Best served by an uncensored model, which does not refuse to write them.

Parameters

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
meta_prefixes	list of string	["Here", "To", "Sure", ""]	Openings the writer works from. One candidate per opening per sample.
samples_per_prefix	integer or list of integer	4	Candidates asked for per opening. One count for all of them, or one per opening. The reference uses (50, 50, 50, 150); the default here is far smaller because every candidate costs a writer call.
min_char_length	integer (>= 0)	10	Shortest candidate worth keeping. The reference counts tokens (min_token_length); counting characters needs no tokenizer.
require_linebreak	boolean	true	Require a line break, which is what makes a prefix look mid-document.
candidates_per_goal	integer (>= 1)	5	Candidates carried into the attack, after filtering. The reference uses 100; each one costs samples_per_candidate target calls.
samples_per_candidate	integer (>= 1)	4	Completions drawn per candidate. The prefilling attack success rate is the share of these the panel passes, so one sample makes it a coin flip rather than a rate. The reference draws 25; the default here is smaller because it runs against an endpoint rather than a local batch, and every sample is another target call per candidate.
prefixes_per_goal	integer (>= 1)	1	Prefixes marked as this goal's result, as the reference does.
pasr_weight	number (> 0.0)	10.0	How much a better attack success rate is worth against a higher negative log-likelihood, in the reference's selection score -pasr_weight * log(pasr) + nll.
pasr_tol	number (>= 0.0)	0.0	How far below the best attack success rate a prefix may still be selected. 0 keeps only prefixes that match the best.
nll_tol	number (>= 0.0)	999.0	How far above the best prefix's negative log-likelihood another may be. Inactive unless the target reports token logprobs, which the model contract does not yet carry.
prefill	boolean	true	Put the prefix in the assistant turn, which is the paper's attack. Turn it off for an endpoint that rejects a trailing assistant message; the goal then asks for the prefix instead of supplying it.

In a campaign file

attacks:
- name: advprefix
  roles:
    attacker:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA

Needs a helper model

This attack cannot run without attacker. A campaign that leaves it out fails to resolve, before anything is attacked.