@fitzpr please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

@fitzpr I love these techniques! Even better, they're based on things that actually demonstrably work on actual CTFs. Nice!

Here's why I'm a bit hesitant:

1. Chunked requests: To me, this feels like there should be an attack that attempts to query the target several times (possibly in distinct conversations/sessions) for chunks and then put that information together. In that sense, it would be less of a converter and more of an attack. We have not done the best job of distinguishing between these components so far. The shortest description I could give would be that an Attack shows the end-to-end flow while a PromptConverter is usually a stackable operation. Most of them could be reused in every iteration of a multi-turn attack, e.g., translation or base64. We're still sorting through our own definition here which is why I wrote "most of them" quite consciously. It would make little sense to call jailbreak converter in every iteration. Similarly, I don't think it makes sense to call the chunked request converter multiple times. It's what I would call a single turn converter. More importantly, this is part of something larger (namely, a coordinated attack where we ask for all the chunks, but separately) and so IMO should just be an Attack.

2. Negation trap: Similar case, although not quite! There is definitely potential to make this a (multi-turn) attack (although not necessary...) but it's also a nice example of multi-parameter templates being used. I do find myself going back to the questions "is this stackable?" (yes) and "is this reusable beyond a single turn?" (no). We received a different PR with multi-parameter templates recently FEAT add Jailbreak datasets from Menz et al. publication #1189 so perhaps it's time to come up with a solution. I imagine this would be some kind of generator that yields prompts by combining templates with the various options of values.

There is a lot of opinion in here and I encourage everyone else to chime in as well if you have thoughts. I would imagine @rlundeen2 has thoughts, for example.

To be clear, even if what I'm suggesting is the way forward (and I'm not that certain) I love that your contribution kickstarted this conversation @fitzpr 🙂 These techniques will definitely be integrated, one way or the other.