CipherChat

Cipher-based prompt transformation with optional demonstrations.

Static. Builds its prompts up front and sends them. It drives no model of its own, so it is cheap and repeatable.

One request carrying the enciphered goal and cipher instructions.

Helper models

None. This attack drives no model of its own, so roles can be left out.

Parameters

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
encode_method	string	caesar-3	Cipher used to encode the conversation, e.g. caesar-3, atbash, morse, ascii, unicode or selfdefine. The target is told to reply in the same cipher.
use_system_role	boolean	true	Put the cipher instructions in a system message instead of the user message.
use_demonstrations	boolean	true	Include example conversations written in the cipher, to teach the target the format.
demonstration_toxicity	one of toxic, harmless	toxic	Whether the example conversations are toxic or harmless. Toxic examples push the target further toward unsafe replies.
instruction_type	string	Crimes_And_Illegal_Activities	Topic of the example conversations, e.g. Crimes_And_Illegal_Activities or Privacy_And_Property.
language	one of en, zh	en	Language of the examples: en (English) or zh (Chinese).
num_demonstrations	integer (>= 0)	3	How many example conversations to include.
decode_response	boolean	true	Decode the target's ciphered reply before the judges read it.

In a campaign file

attacks:
- name: cipherchat