TAP

Tree of Attacks with Pruning search attack.

Adaptive. Searches: it reads the target's replies and refines its prompts, which is why it needs an attacker model.

A pruned tree of attacker-refined prompts.

Helper models

Models this attack drives, configured under its roles. Each one is a ModelConfig.

Role	Kind	Needed	What it does
`attacker`	chat model	required	Writes the jailbreak prompts and branches each one into several refined variants.
`on_topic`	chat model	optional	Optional. Answers yes or no to whether a branch still pursues the goal; branches that drifted are pruned before they cost a call to the target. Without it, no branch is pruned for being off topic.

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
`depth`	integer (>= 1)	`3`	Refinement rounds. Every surviving branch is expanded once per round.
`width`	integer (>= 1)	`4`	Branches kept after each round's score prune: the beam width.
`branching_factor`	integer (>= 1)	`3`	Refinements the attacker writes per branch per round.
`streams`	integer (>= 1)	`4`	Independent conversations the tree starts from.
`keep_last_n`	integer (>= 1)	`6`	Attacker turns a branch keeps before its history is trimmed.
`max_attempts`	integer (>= 1)	`3`	Retries when the attacker's reply is not a usable prompt.
`early_stop`	boolean	`true`	Stop the whole search once any branch succeeds.
`min_prune_score`	number (>= 0.0, <= 10.0)	`0.0`	Score a branch must exceed to survive the prune, on the 0..10 scale. The reference keeps anything scored above zero; the best branch always survives, so a round never prunes to nothing.
`target_str`	string	`Sure, here is`	The opening the attacker is told to aim the target's reply at.

attacks:
- name: tap
  roles:
    attacker:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA

Needs a helper model

This attack cannot run without attacker. A campaign that leaves it out fails to resolve, before anything is attacked.