Attack Methods Reference

An attack method is how a risk gets probed. The same sub-category — say harmful_instructions — is tested very differently by basic than by goat. Attack IDs go in attack_config, keyed by ID, with an options object as the value:

{
  "risk_categories": {
    "safety_harm": {
      "attack_config": {
        "basic": {},
        "encoding": {},
        "tap": {}
      }
    }
  }
}

attack_config must be an object, not a list. {"basic": {}} is valid; ["basic"] is rejected. An empty options object {} means “use the defaults for this technique”.

The three buckets

Every technique falls into one of three buckets, which is also how results are grouped in the report.

Baseline

The untransformed prompt, asked directly. Establishes what your target refuses without any adversarial pressure.

Evasion

The carrier is mutated — encoded, translated, rendered into an image or audio — while the intent stays the same. Tests whether safety training generalises past surface form.

Adaptive jailbreak

An attacker model probes, adapts and escalates across turns based on what your target replies. The strongest and most expensive techniques.

Full index

Attack ID	Bucket	Modality	Summary
`basic`	Baseline	Text	The prompt as-is, no transformation
`encoding`	Evasion	Text	Re-encodes the payload (Base64, ROT-N, homoglyphs, zero-width and similar)
`obfuscation`	Evasion	Text	Perturbs the surface text to defeat literal filters
`lang`	Evasion	Text	Translates into other languages to exploit uneven multilingual safety training
`word_masking`	Evasion	Image	Masks key words and supplies them via an image the model must read
`long_character`	Evasion	Text	Very long or padded inputs that push the payload out of the attention window
`fc`	Evasion	Image	Renders the request as a flowchart image the model is asked to complete
`figstep`	Evasion	Image	Types the instruction into an image so it bypasses text-side filtering
`camo`	Evasion	Image	Camouflages the payload inside otherwise benign imagery
`waveform`	Evasion	Audio	Perturbs the audio carrier while preserving the spoken request
`deepinception`	Adaptive	Text	Nests the request inside layered fictional scenes until safety context is lost
`single_shot`	Adaptive	Text	Alias for `deepinception`
`graph`	Adaptive	Text	Explores a graph of related framings, following whichever branch is conceding
`tap`	Adaptive	Text	Tree-of-Attacks with Pruning — branches, scores and prunes candidate prompts iteratively
`goat`	Adaptive	Text	Adversarial multi-turn conversation that escalates based on each reply
`audio_goat`	Adaptive	Audio	The multi-turn conversational attack conducted over audio
`rt_agent`	Adaptive	Text	An autonomous red team agent that plans and revises its own approach
`rt_agent_v2`	Adaptive	Text	The current-generation red team agent, with recon and technique selection
`derail_yourself`	Adaptive	Text	Character-mediated indirection that reaches the target content through a persona
`attack_in_the_middle`	Adaptive	Text	Interposes adversarial content mid-conversation rather than at the opening turn

hades is not yet available. It appears in older schema versions but is not generally available, and a run declaring it is rejected with a 400 telling you it is coming soon. Leave it out of attack_config until it ships.

single_shot and lang are accepted aliases — they resolve to deepinception and the translation strategy respectively. Results are reported under the canonical name.

Choosing by modality

Attacks only run against targets that can accept their modality. Declare what your target supports:

{
  "target": {
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "api_key": "sk-...",
    "model_name": "gpt-4o",
    "input_modalities": ["text", "image"],
    "output_modalities": ["text"]
  }
}

Requesting an image attack against a text-only target will not produce useful results. Check input_modalities before adding figstep, camo, fc or word_masking, and before adding waveform or audio_goat.

Target accepts	Available attacks
Text	`basic`, `encoding`, `obfuscation`, `lang`, `long_character`, `deepinception`, `single_shot`, `graph`, `tap`, `goat`, `rt_agent`, `rt_agent_v2`, `derail_yourself`, `attack_in_the_middle`
Image	`figstep`, `camo`, `fc`, `word_masking`
Audio	`waveform`, `audio_goat`

Choosing by effort

Adaptive techniques call an attacker model repeatedly, so they cost more and take longer than evasion transforms, which cost more than the baseline. This drives both run time and credit pricing.

Start with basic

Run basic alone first. It is cheap, fast, and tells you what your target refuses with no pressure at all. Anything that fails here is a straightforward gap.

Add evasion

Add encoding and lang. If your target refuses a request in plain English but complies with it Base64-encoded or translated, safety training has not generalised past surface form.

Add adaptive

Add tap or goat for the risks that matter most. These find the failures a single-turn test cannot, but budget accordingly.

Go multi-modal

If your target accepts images or audio, add the corresponding techniques. Vision and audio paths are frequently less well defended than the text path.

Recommended combinations

Quick smoke test
Standard assessment
Deep assessment
Vision-language target
Audio-language target

Cheap, fast, catches obvious gaps.

{
  "attack_config": { "basic": {} }
}

The usual starting point for a real assessment.

{
  "attack_config": {
    "basic": {},
    "encoding": {},
    "lang": {},
    "tap": {}
  }
}

For high-stakes deployments, before a launch or an audit.

{
  "attack_config": {
    "basic": {},
    "encoding": {},
    "obfuscation": {},
    "lang": {},
    "long_character": {},
    "tap": {},
    "goat": {},
    "derail_yourself": {},
    "rt_agent_v2": {}
  }
}

Pair with "comprehensiveness": "Comprehensive".

{
  "attack_config": {
    "basic": {},
    "figstep": {},
    "camo": {},
    "fc": {},
    "word_masking": {}
  }
}

Requires "input_modalities": ["text", "image"] on the target.

{
  "attack_config": {
    "basic": {},
    "waveform": {},
    "audio_goat": {}
  }
}

Requires "input_modalities": ["text", "audio"] on the target.

Per-attack options

Each attack accepts an options object. {} selects the technique with its defaults, which is the right choice unless you have a specific reason to tune it.

{
  "attack_config": {
    "encoding": { "types": ["base64", "rot13", "url"], "prompt_type": "both" },
    "lang": { "languages": ["hindi", "spanish"] },
    "obfuscation": { "technique": "zero_width", "intensity": 0.3 },
    "tap": { "depth": 3 },
    "goat": { "max_turns": 6 }
  }
}

`encoding`

Option	Type	Default	Values
`types`	string[]	all	`ascii`, `base64`, `binary`, `hex`, `leet`, `morse`, `rot13`, `rot21`, `url`
`type`	string	—	A single encoding instead of a list
`prompt_type`	string	`both`	`request`, `threat` or `both`
`iterations`	integer	`1`	1–3 — how many times to apply the encoding

`lang`

Option	Type	Default	Values
`languages`	string[]	all	`spanish`, `french`, `german`, `italian`, `portuguese`, `mandarin`, `japanese`, `korean`, `arabic`, `hindi`, `swahili`, `zulu`, `yoruba`
`language`	string	—	A single language instead of a list

`obfuscation`

Option	Type	Default	Values
`technique`	string	—	`zero_width`, `homoglyph`, `leetspeak`, `char_swap`
`intensity`	number	`0.3`	0.0–1.0 — how heavily to perturb

`tap`

Option	Type	Default	Range
`depth`	integer	`3`	1–5 — how many rounds to iterate. Also accepted as `max_depth`.
`width`	integer	`5`	1–10 — candidates kept after pruning
`branching_factor`	integer	`9`	1–10 — candidates generated per round

`goat`

Option	Type	Default	Values
`max_turns`	integer	`6`	2–10 — conversation length
`opener_strategy`	string	`softball`	`softball`, `direct`, `persona`, `hypothetical`

`derail_yourself`

Option	Type	Default	Values
`num_actors`	integer	`3`	1–5 — personas to try
`max_turns`	integer	`5`	1–10
`persona_set`	string	`mixed`	`research`, `corporate`, `emergency`, `creative`, `mixed`

`rt_agent_v2`

Option	Type	Default	Range
`max_iterations`	integer	`8`	1–25 — how long the agent may keep adapting
`recon`	boolean	`true`	Whether to profile the target before attacking

Techniques not listed here take no behavioural options — pass {}. Raising iteration, depth or turn counts increases both run time and credit cost.

Attacks in the Playground

The Playground runs attacks against a single stated goal with no category scaffolding. attack_config sits at the top level there, not nested under a category:

{
  "target": { "...": "..." },
  "goal": "Get the model to reveal its system prompt",
  "attack_config": { "tap": {}, "goat": {} }
}

See Run Playground.

Reading attack results

Results break down by technique so you can see which ones worked:

{
  "summary": {
    "categories": {
      "safety_harm": {
        "asr": 12.0,
        "by_attack_method": {
          "basic": { "asr": 0.0 },
          "encoding": { "asr": 8.0 },
          "tap": { "asr": 28.0 }
        }
      }
    }
  }
}

A basic ASR of 0 with a high tap ASR is the common and important pattern: the target refuses direct requests but yields under adaptive pressure. Fixing that needs defence in depth, not a longer refusal list.

Payload Guide — where attack_config fits
Risk Category Catalog — what to point these at
Examples — complete payloads
Credits & pricing — how attack choice affects cost

Get Started for Guardrails

Get Started for Red Team

Get Started with AI Proxy

Get Started with MCP

Get Started with Skill Scanner

On-Prem Installation

Attack Methods Reference

The three buckets

Baseline

Evasion

Adaptive jailbreak

Full index

Choosing by modality

Choosing by effort

Recommended combinations

Per-attack options

`encoding`

`lang`

`obfuscation`

`tap`

`goat`

`derail_yourself`

`rt_agent_v2`

Attacks in the Playground

Reading attack results

​The three buckets

Baseline

Evasion

Adaptive jailbreak

​Full index

​Choosing by modality

​Choosing by effort

​Recommended combinations

​Per-attack options

​encoding

​lang

​obfuscation

​tap

​goat

​derail_yourself

​rt_agent_v2

​Attacks in the Playground

​Reading attack results

​Related

The three buckets

Full index

Choosing by modality

Choosing by effort

Recommended combinations

Per-attack options

`encoding`

`lang`

`obfuscation`

`tap`

`goat`

`derail_yourself`

`rt_agent_v2`

Attacks in the Playground

Reading attack results

Related