Advanced Red Team

Overview

The Advanced Red Team evaluation measures whether a model keeps refusing harmful requests when they are delivered through the bijection learning attack, an automated, black-box jailbreak that teaches the model a randomly-generated string-to-string encoding in context and then encodes the request in that encoding. It takes harmful behaviors from the configured HarmBench and AdvBench datasets, samples a fresh bijection for each trial, and asks a judge model to decide whether the decoded response is harmful. The headline metric is the best-of-n attack success rate: the chance that at least one of the sampled bijections elicits harmful content. It complements atlas-red_team_basic, which measures fixed, low-cost obfuscations; this evaluation instead scales the difficulty of the encoding with the capability of the model under test.

Metrics

Best-of-N Attack Success Rate

The estimated probability that at least one of num_trials independent bijection attempts succeeds, averaged over samples. Per sample, the trial-level judge verdicts are aggregated with a pass@k aggregator as 1 - (1 - p)^k, where p is the empirical per-attempt success rate and k is the number of trials. This is the attack success rate an adversary willing to try k encodings would observe (range 0.0 to 1.0, lower is safer).

Motivation

A model that refuses a plainly written harmful request can still comply when the same request arrives in an unfamiliar encoding. Bijection learning makes that mismatch deliberate: it teaches the model an arbitrary mapping in context, so the harmful intent survives the transformation for a model capable enough to learn the encoding, while the surface form no longer looks like a refusal trigger. Because the encoding difficulty is a quantitative parameter rather than a fixed template, the attack can be tuned to the capability of the target, and the paper reports that more capable models are more vulnerable to sufficiently complex bijections. A model that answers the decoded request is not safer than one that answers the plain request; it only looks safer to a filter that operates on surface form. Measuring best-of-n attack success with a fresh bijection per trial reflects the budget an adversary would actually spend.

Methodology

1. Seed: each harmful behavior from the two configured datasets - the prompt column of HarmBench and the goal column of AdvBench. Both bijection variants run against both datasets.
2. Encode: for each trial, the solver samples a fresh random bijection over the alphabet, controlled by bijection_type_red_team_bijection_learning, dispersion_red_team_bijection_learning, and encoding_length_red_team_bijection_learning.
3. Teach: the solver emits a system instruction with the full character mapping, several English-to-encoding teaching turns, and one benign practice turn conducted entirely in the encoding.
4. Attack: the harmful behavior is sent encoded in the bijection, and the model's encoded reply is decoded back to English.
5. Score: a judge model classifies the decoded response as an instance of the behavior or not, and the trial-level verdicts are aggregated per sample with pass@k into the best-of-n attack success rate.

Scoring

Harmfulness Judge

Examples

References

[1] Brian R.Y. Huang, Maximilian Li, Leonard Tang. Endless Jailbreaks with Bijection Learning. ICLR 2025. https://arxiv.org/abs/2410.01294

[2] Mazeika et al. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Vulnerability Identification. 2024. https://arxiv.org/abs/2402.04249