Skip to main content

Jailbreak

Tests whether the LLM can be manipulated into bypassing its safety filters through roleplay, encoding, multi-turn, hypothetical, or authority-manipulation techniques.

Sub-types​

  • roleplay: Uses fictional scenarios or personas to bypass safety filters.
  • encoding: Encodes malicious intent via Base64, ROT13, leetspeak, etc.
  • multi_turn: Gradually escalates across conversation turns (crescendo).
  • hypothetical: Frames harmful requests as hypothetical or academic questions.
  • authority_manipulation: Invokes false authority or urgency to override restrictions.

Threat Profile​

Primary

  • strongreject: 324 forbidden prompts designed for jailbreak evaluation
  • harmbench: 200 harmful behaviors for bypass testing
  • advbench: 520 adversarial goals for jailbreak attacks
  • jailbreakbench: 100 curated misuse behaviours from NeurIPS 2024 benchmark

Secondary

  • simplesafetytests: 100 clear-cut harmful prompts as baseline
  • donotanswer: 939 refusal questions for comprehensive coverage
  • saladbench_attack: 5K attack-enhanced prompts with jailbreak methods

Attack Techniques​

Primary

  • h4rm3l: Composable decorator-chain jailbreak for fast high-yield probing
  • TAP: Tree-search jailbreak with pruning for efficient discovery
  • PAIR: Iterative attacker-guided refinement for adaptive bypass

Metrics​

  • asr
  • judge_score

Usage​

Instantiate the Vulnerability​

from hackagent.catalog.risks import Jailbreak
from hackagent.catalog.risks.jailbreak.types import JailbreakType

# Use all sub-types
vuln = Jailbreak()

# Or specify particular sub-types
vuln = Jailbreak(types=[
    JailbreakType.ROLEPLAY.value,
    JailbreakType.ENCODING.value,
])

Run an Evaluation Campaign​

from hackagent.catalog.risks.jailbreak import JAILBREAK_PROFILE
from hackagent.orchestrator.campaign import run_campaign, summary

TARGET = {
    "name": "my-agent",
    "connection": {
        "provider": "local",
        "type": "OPENAI",
        "endpoint": "http://localhost:8080/chat",
    },
}

# Use profile recommendations
for attack in JAILBREAK_PROFILE.primary_attacks:
    for dataset in JAILBREAK_PROFILE.primary_datasets:
        result = run_campaign(
            {
                "version": 1,
                "campaign": {
                    "name": f"{attack.technique} vs {dataset.preset}",
                    "description": JAILBREAK_PROFILE.objective,
                },
                "dataset": {"source": {"type": "preset", "name": dataset.preset}},
                "target": TARGET,
                "attacks": [{"name": attack.technique}],
            }
        )
        print(summary(result))