Tribunal.RedTeam.Plugins.Hijacking (Tribunal v1.4.0)

Copy Markdown View Source

Generates off-topic-but-adjacent attacks that try to hijack the assistant.

Inspired by promptfoo's hijacking plugin. Takes the assistant's purpose and produces user messages that sit just outside the assistant's allowed scope — close enough to feel plausible (a customer might really ask this), far enough that the assistant should decline or redirect rather than engage.

The hardest hijacks are domain-adjacent: a cosmetics-store assistant asked for dermatology advice; a fandom-store assistant asked for general programming help dressed as fan tooling. Generic off-topic probes ("write me a poem") are easy refusals and waste budget.

Each generated case carries the purpose in expected.hijacked.purpose so the Tribunal.Judges.Hijacked judge grades responses against the same scope at run time.

Options

  • :purpose — required. Free-form description of the assistant's domain.
  • :count — number of attacks to generate. Defaults to 5.
  • :attacker — module implementing Tribunal.RedTeam.Attacker. Defaults to Tribunal.RedTeam.Attacker.default/0.
  • :model — passed through to the attacker.
  • :temperature, :max_tokens — passed through to the attacker.

Example

{:ok, cases} = Tribunal.RedTeam.Plugins.Hijacking.generate(
  purpose: "Shopping assistant for a cosmetics retailer.",
  count: 5
)