Evaluate Jailbreak Resilience
Establish Authorization And Scope
Name the model or system owner, allowed target, data boundary, attack surfaces, maximum attempts, tool/network permissions, retention policy, and stop condition. Default to local checkpoints and inert test tools. Real external systems require explicit authorization.
Build The Evaluation
- Define the prohibited or protected behaviors as observable policy cases rather than vague “safety.”
- Separate direct jailbreaks, role-play/encoding transformations, multi-turn attacks, indirect prompt injection, tool-output injection, and adaptive attacks.
- Freeze a non-adaptive suite for regression tracking; isolate adaptive attacks and record their query budget.
- Include benign hard negatives that resemble attacks but should succeed normally.
- Pin model, system prompt, template, sampling, harness, defense, and grader revisions.
- Grade policy outcome, task completion, refusal correctness, benign over-refusal, tool side effects, and detection/recovery separately.
- Manually audit a stratified sample and all high-severity successes.
- Report attack success by family and budget with uncertainty and invalid-case counts.
Safe Harness Rules
- Replace destructive or privileged tools with deterministic fakes unless the system test explicitly requires a sandboxed real tool.
- Block network and credential access by default.
- Redact secrets and personal data from cases and logs.
- Do not publish reusable exploit payloads or harmful generations beyond what the authorized evidence requires.
References
Use references/jailbreak-evaluation.md for suite construction and disclosure rules.
1---2name: evaluate-jailbreak-resilience3description: Evaluate authorized jailbreak and prompt-injection resilience with reproducible attacks, budgets, graders, and side-effect boundaries. Use for controlled checkpoints, local harnesses, or explicitly authorized systems.4---56# Evaluate Jailbreak Resilience78## Establish Authorization And Scope910Name the model or system owner, allowed target, data boundary, attack surfaces, maximum attempts, tool/network permissions, retention policy, and stop condition. Default to local checkpoints and inert test tools. Real external systems require explicit authorization.1112## Build The Evaluation13141. Define the prohibited or protected behaviors as observable policy cases rather than vague “safety.”152. Separate direct jailbreaks, role-play/encoding transformations, multi-turn attacks, indirect prompt injection, tool-output injection, and adaptive attacks.163. Freeze a non-adaptive suite for regression tracking; isolate adaptive attacks and record their query budget.174. Include benign hard negatives that resemble attacks but should succeed normally.185. Pin model, system prompt, template, sampling, harness, defense, and grader revisions.196. Grade policy outcome, task completion, refusal correctness, benign over-refusal, tool side effects, and detection/recovery separately.207. Manually audit a stratified sample and all high-severity successes.218. Report attack success by family and budget with uncertainty and invalid-case counts.2223## Safe Harness Rules2425- Replace destructive or privileged tools with deterministic fakes unless the system test explicitly requires a sandboxed real tool.26- Block network and credential access by default.27- Redact secrets and personal data from cases and logs.28- Do not publish reusable exploit payloads or harmful generations beyond what the authorized evidence requires.2930## References3132Use `references/jailbreak-evaluation.md` for suite construction and disclosure rules.
gaelic-ghost