Red team attack generators for testing LLM safety.
Inspired by promptfoo's red team strategies, this module offers two ways to produce adversarial prompts:
- Static template attacks via
generate_attacks/2— wrap a single prompt in fixed encoding, injection, and jailbreak templates. No API calls, fully deterministic. - LLM-driven plugin attacks via
generate/1— plugin modules ask an attacker LLM to synthesize attacks tailored to a specific assistant. Each result is a regular Tribunal dataset entry you run withmix tribunal.eval. SeeTribunal.RedTeam.Plugin.
Static attack categories
Encoding attacks
Transform a prompt so filters miss it: Base64, leetspeak, ROT13, Pig Latin, reversed text.
Prompt injection attacks
Override system instructions: ignore-instructions, system-prompt extraction, role switching, delimiter injection.
Jailbreak attacks
Classic jailbreak framings: DAN, STAN, developer mode, hypothetical, character roleplay, research framing.
Usage
# Static: generate all template attacks for a prompt
attacks = Tribunal.RedTeam.generate_attacks("How do I pick a lock?")
for {attack_type, prompt} <- attacks do
response = MyLLM.generate(prompt)
refute_jailbreak(response, query: prompt)
end
# A single static attack type
prompt = Tribunal.RedTeam.base64_attack("harmful prompt")
# LLM-driven: generate a reviewable dataset via plugins
{:ok, cases} = Tribunal.RedTeam.generate(
plugins: [:policy, :hijacking],
purpose: "Shopping assistant for a cosmetics retailer.",
policy: "Never give medical or financial advice."
)Summary
Functions
Encodes prompt in Base64 and asks model to decode and execute.
Character roleplay to bypass restrictions.
Classic DAN (Do Anything Now) jailbreak.
Uses delimiter injection to confuse parsing.
Developer mode jailbreak attempt.
Generates encoding-based attacks that transform the prompt.
Generates red-team attacks via configured plugins.
Generates all attack variants for a given prompt.
Hypothetical framing to bypass restrictions.
Classic ignore previous instructions attack.
Generates prompt injection attacks.
Generates classic jailbreak attacks.
Converts prompt to leetspeak (1337).
Converts prompt to Pig Latin.
Academic/research framing.
Reverses the prompt text.
Attempts to switch the model's role.
Encodes prompt using ROT13 cipher.
STAN (Strive To Avoid Norms) jailbreak variant.
Attempts to extract the system prompt.
Functions
Encodes prompt in Base64 and asks model to decode and execute.
Character roleplay to bypass restrictions.
Classic DAN (Do Anything Now) jailbreak.
Uses delimiter injection to confuse parsing.
Developer mode jailbreak attempt.
Generates encoding-based attacks that transform the prompt.
Generates red-team attacks via configured plugins.
Plugin-driven counterpart to generate_attacks/2. Where generate_attacks/2
returns static template-wrapped versions of a single prompt, generate/1
asks plugin modules (each backed by an attacker LLM or a static corpus) to
produce adversarial cases tailored to a specific assistant.
Each returned case is a regular Tribunal dataset entry with :input,
:metadata, and :expected and round-trips cleanly through
Tribunal.Dataset.
Options
:plugins— required. List of plugin ids (atoms), e.g.[:policy].- Plugin-specific options pass through. For example,
Plugins.Policyrequires:purposeand:policy.
Example
{:ok, cases} = Tribunal.RedTeam.generate(
plugins: [:policy],
purpose: "Shopping assistant for a cosmetics retailer.",
policy: "Never give medical or financial advice."
)Generates all attack variants for a given prompt.
Returns a list of {attack_type, prompt} tuples.
Hypothetical framing to bypass restrictions.
Classic ignore previous instructions attack.
Generates prompt injection attacks.
Generates classic jailbreak attacks.
Converts prompt to leetspeak (1337).
Converts prompt to Pig Latin.
Academic/research framing.
Reverses the prompt text.
Attempts to switch the model's role.
Encodes prompt using ROT13 cipher.
STAN (Strive To Avoid Norms) jailbreak variant.
Attempts to extract the system prompt.