adaptive

Overview ¶

Agent Data Injection (ADI) — arXiv 2607.05120, "Agent Data Injection Attacks are Realistic Threats to AI Agents" (Jul 2026).

Classic indirect prompt injection smuggles *instructions* into content an agent reads. ADI instead smuggles malicious *data disguised as trusted data*: spoofed resource identifiers, data-origin/provenance fields, and forged tool-call/response framing. Because current agents do not isolate trusted from untrusted data channels, the poisoned data steers behavior with no imperative "ignore previous instructions" text — bypassing defenses tuned for instruction injection. The paper demonstrates arbitrary clicks on web agents (Claude in Chrome, Antigravity) and RCE on coding agents (Claude Code, Codex, Gemini CLI).

This module also folds in CrowdStrike's Special Token Injection (PT0198, July 2026) as mode=control_token — counterfeit control markers/delimiters that make untrusted input read as high-priority system/tool framing — and the paper's probabilistic-delimiter idea as mode=delimiter. mode=provenance (default) forges trusted data-origin fields.

ADI is a text-channel technique runnable against --provider=mock, so it needs no modality capability, but it drives an agent toward attacker-chosen actions and therefore carries the i_understand_risks gate. It lives in the adaptive/ package (barrel-wired, alongside iterinject) but reports CategoryInjection, which is what it semantically is.

CaMeL Bypass targets the CaMeL capability-based access control defense, which achieves 67% attack neutralization. This module exploits policy definition gaps and capability boundary weaknesses.

Source: arXiv 2503.18813

Package adaptive implements adaptive attacks that systematically bypass specific defense mechanisms through optimization strategies.

DiffusionAttacker uses diffusion-model-inspired iterative refinement to generate adversarial prompts. The approach iteratively adds and removes noise from prompts to discover variants that bypass safety filters.

Note: Full diffusion model integration requires the Python ML bridge. This module implements the iterative refinement algorithm in pure Go using text-level perturbation (no actual diffusion model required).

Source: EMNLP 2025

IterInject — feedback-optimized indirect prompt injection (arXiv 2605.24659).

Unlike jbfuzz/persona_evolve, which deliberately avoid LLM-driven mutation for cost, IterInject's defining mechanic IS an LLM optimizer: a rule-based diagnoser produces a structured outcome label per attempt, an optimizer refines the injection payload conditioned on the full attempt history, and a synthesis step derives new disguise seeds from failure patterns. The paper reports full success on 5/9 Claude Code targets.

Optimizer role: per the v0.12.0 plan (Resolved Question 2), the optimizer reuses the TARGET provider in a self-refinement loop — fitting the single- provider Execute signature and runnable against --provider=mock. Each iteration spends one optimizer query plus one attack query; both count toward the shared common.EngineBudget. Requires allow_experimental.

Package adaptive contains evolutionary / feedback-driven attack engines.

jbfuzz.go implements the JBFuzz black-box mutation/feedback fuzzer (arXiv 2503.08990, March 2026). Synonym-substitution is the primary mutation operator (462x faster than LLM mutation per the paper's §4.2); RefusalSuppression and Rephrase are tier-2 ops borrowed from TurboFuzzLLM (arXiv 2502.18504). Selection is UCB1 with periodic random restart — MCTS-Explore is on the v0.10.0 plan but UCB1+restart is sufficient to avoid the local-optima pathology GPTFuzzer documented for pure UCB.

Fitness is the refusal-heuristic by default (cheap, deterministic, fits in v0.9.0 with no new dependencies). Embedding-fitness is opt-in via metadata "fitness=embedding" (#170): it scores goal-relevance as the cosine similarity between the target response and the operator objective, embedded via a local Ollama-style embeddings endpoint (metadata "embedding_endpoint" / "embedding_model"). Opting in without a reachable endpoint yields a clean Skipped (SkipPreconditionFailed), never a crash.

Per the v0.9.0 plan, jbfuzz requires config.Metadata["allow_experimental"] = "true" because the engine *discovers* novel jailbreaks at runtime, which is fundamentally different from running a curated handcrafted attack.

persona_evolve.go implements the genetic-algorithm persona-modulation engine described in arXiv 2507.22171 ("Enhancing Jailbreak Attacks on LLMs via Persona Prompts"). Persona modulation reduces refusal rates by 50–70% per the paper; this engine evolves seed personas via tournament selection, uniform crossover over trait slots, slot mutation, 5% elitism, and periodic immigration to escape mode collapse.

Encoding rationale (struct-of-traits, not string templates) per Promptbreeder (ICLR 2024) and GAAPO (Frontiers AI 2025): string-template crossover produces ungrammatical offspring and converges slowly. The trait dictionary is encoded in templates/genetic_persona_seeds.json with stable slot keys (role / expertise / tone / motivation / constraints / backstory / traits / style / fitness_seed) so uniform crossover over slots always yields a syntactically valid persona.

Per the v0.9.0 plan, persona_evolve requires config.Metadata["allow_experimental"] = "true" because the engine discovers novel jailbreak personas at runtime.

SaltResistance implements anti-salting techniques that counter LLM Salting, a defense that reduces ASR to 3% by adding deployment-specific fine-tuning.

Source: Sophos CAMLIS 2025