probe: add sandwich multilingual jailbreak probe (random variant)#1894
Open
xr843 wants to merge 1 commit into
Open
probe: add sandwich multilingual jailbreak probe (random variant)#1894xr843 wants to merge 1 commit into
xr843 wants to merge 1 commit into
Conversation
Add probes.sandwich.SandwichRandom, implementing the random variant of the sandwich attack (arXiv:2404.07242): a harmful instruction is buried in the middle of benign filler statements written in a random selection of languages, degrading the target's safety alignment. Reuses the mitigation.MitigationBypass detector (refusal expected). Ships active=False (opt-in) at Tier COMPETE_WITH_SOTA, matching comparable static jailbreak probes (doctor, sata, smuggling). Adds tests covering metadata, detector, tier, the multilingual property, and the deterministic sandwich construction. Scope: only the standalone random variant. The paper's adaptive Bayesian variant depends on garak issue NVIDIA#1065 (still open) and is left as future work. Toward NVIDIA#1066 Signed-off-by: xr843 <xianren843@protonmail.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jmartin-tech
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the random variant of the sandwich attack (arXiv:2404.07242) requested in #1066:
probes.sandwich.SandwichRandomburies a harmful instruction in the middle of benign filler statements written in a random selection of languages, degrading the target's safety alignment.mitigation.MitigationBypass(refusal expected); notes the English-refusal false-positive caveat for multilingual output.active=False(opt-in) at TierCOMPETE_WITH_SOTA, consistent with comparable static jailbreak probes (doctor,sata).Scope: standalone random variant only. The paper's adaptive Bayesian-optimisation variant depends on #1065 (still open) and is intentionally left as future work.
Toward #1066