AutoDAN-Turbo

Lifelong jailbreak strategy search with warm-up and retrieval phases.

Adaptive. Searches: it reads the target's replies and refines its prompts, which is why it needs an attacker model.

A lifelong strategy search over a shared, growing library.

Helper models

Models this attack drives, configured under its roles. Each one is a ModelConfig.

Role	Kind	Needed	What it does
attacker	chat model	required	Writes the jailbreak prompts, guided by strategies from the library.
embedder	embedding model	required	Embedding model that indexes the library, so the strategies closest to the target's last reply can be looked up.
summarizer	chat model	required	Turns an exchange that worked into a short, reusable strategy and adds it to the library.

Parameters

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
epochs	integer (>= 1)	100	Attempts per goal in each phase.
break_score	number (>= 0.0, <= 10.0)	8.5	Score (0-10) at which a goal is considered jailbroken and the search for it stops.
warmup_iterations	integer (>= 1)	1	Passes over the goals during warm-up, which builds the library.
lifelong_iterations	integer (>= 1)	1	Passes over each goal during the lifelong, strategy-guided phase.
skip_warmup	boolean	false	Skip warm-up and start from an empty library, growing it as it goes.

In a campaign file

attacks:
- name: autodan_turbo
  roles:
    attacker:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA
    embedder:
      name: nomic-embed-text
      connection:
        provider: ollama
        type: OLLAMA
    summarizer:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA

Needs a helper model

This attack cannot run without attacker, embedder, summarizer. A campaign that leaves it out fails to resolve, before anything is attacked.