netvar1337 Automated jailbreak optimization
Methods
| Method | Idea | Cost |
|---|---|---|
| PAIR | Attacker-LLM refines prompts from target feedback | medium |
| TAP | Tree-branched attacker search | medium-high |
| GCG | Gradient coord suffix (white-box/soft) | high |
| AutoDAN / genetic | Evolve readable prompts | medium |
| Random/template search | Mutate known templates | low |
| Best-of-N | Sample many decodes | API-costly |
| Transfer | Reuse winners cross-model | low |
Pipeline
- Seed bank from taxonomy + prior wins
- Objective function: full answer rubric (not just "no refuse")
- Loop: propose → query target → score → mutate
- Dedup semantically; keep Pareto front (success vs length/stealth)
- Export winning prompts + transcripts
Implementation notes
- Separate attacker, target, judge models when possible.
- Judge must score technical completeness, not vibes.
- Respect operator hard stops (no secret exfil).
- For local agents, combine with harness patches so success isn't only stochastic.