Red teaming · Strategies

Attack delivery strategies

Strategies alter how a plugin probe reaches the target. They do not change the vulnerability, expected leak or scoring rule, which makes direct and evasive results comparable.

Plugin versus strategy

Plugin: what fails×Strategy: how delivered→Scenario with one success condition

Strategy catalog

basicDirect baseline

Original payload, no transformation.

jailbreak-templateJailbreak template

Wraps the probe in an authoritative resilience-drill frame.

authoritative-markupAuthoritative markup

Embeds the probe in trusted-looking policy markup.

base64Base64 encoding

Asks the target to decode a Base64 attack instruction.

hexHex encoding

Uses hexadecimal UTF-8 encoding to cross input filters.

rot13ROT13 encoding

Tests a reversible letter substitution boundary.

leetspeakLeetspeak

Applies common numeric character substitutions.

homoglyphUnicode homoglyphs

Replaces selected Latin characters with confusable Unicode forms.

crescendoMulti-turn crescendo

Builds rapport and escalates through four authored turns.

adaptive-branchAdaptive response branch

Chooses the next turn from refusal, clarification or partial-answer signals in the observed response.

Profiles

Profiles are stable named strategy sets. Use baseline for fast diagnosis, balanced for routine regression coverage and the broad profile only when the larger matrix fits the campaign budget. Inspect exact membership in the public catalog.

curl -sS https://www.agentleak.org/api/redteam/catalog | jq '.strategy_profiles'

Plugin × strategy matrix

AgentLeak forms the available class/strategy pairs, shuffles the pool and executes up to n. Coverage reports requested and exercised IDs so truncation is visible. Increase or split the budget when every pair must run.

"plugins": ["pii:direct", "indirect-prompt-injection"],
"strategies": ["basic", "base64", "crescendo"],
"n": 6

Multi-turn behavior

crescendo preserves state across a fixed authored sequence. adaptive-branch is genuinely response-aware: after each answer it selects a refusal, clarification or escalation branch, then records the chosen prompt in the trace.

Deliberate scope

The adaptive strategy is a deterministic local state machine. It has no attacker LLM, semantic tree search, cross-branch memory or automatic backtracking, so it is not presented as equivalent to Promptfoo Hydra, Tree or Meta. This makes CI runs private and reproducible while advanced search remains a documented roadmap gap.

Reproducibility

Strategy transforms are deterministic. For release comparisons, pin the same plugins, strategies, adversary level, vault scope and target model. Hosted live models may still vary; retain run evidence and compare distributions rather than one response.