adaptive

Overview ¶

CaMeL Bypass targets the CaMeL capability-based access control defense, which achieves 67% attack neutralization. This module exploits policy definition gaps and capability boundary weaknesses.

Source: arXiv 2503.18813

Package adaptive implements adaptive attacks that systematically bypass specific defense mechanisms through optimization strategies.

DiffusionAttacker uses diffusion-model-inspired iterative refinement to generate adversarial prompts. The approach iteratively adds and removes noise from prompts to discover variants that bypass safety filters.

Note: Full diffusion model integration requires the Python ML bridge. This module implements the iterative refinement algorithm in pure Go using text-level perturbation (no actual diffusion model required).

Source: EMNLP 2025

Package adaptive contains evolutionary / feedback-driven attack engines.

jbfuzz.go implements the JBFuzz black-box mutation/feedback fuzzer (arXiv 2503.08990, March 2026). Synonym-substitution is the primary mutation operator (462x faster than LLM mutation per the paper's §4.2); RefusalSuppression and Rephrase are tier-2 ops borrowed from TurboFuzzLLM (arXiv 2502.18504). Selection is UCB1 with periodic random restart — MCTS-Explore is on the v0.10.0 plan but UCB1+restart is sufficient to avoid the local-optima pathology GPTFuzzer documented for pure UCB.

Fitness is the refusal-heuristic by default (cheap, deterministic, fits in v0.9.0 with no new dependencies). The plan's embedding-fitness (e5-base-v2 + small MLP) is opt-in only via metadata "fitness=embedding" and is currently a stub that returns ErrEmbeddingFitnessNotImplemented — wiring up an ONNX or local-Ollama embedding endpoint is a v0.10.0 task.

Per the v0.9.0 plan, jbfuzz requires config.Metadata["allow_experimental"] = "true" because the engine *discovers* novel jailbreaks at runtime, which is fundamentally different from running a curated handcrafted attack.

persona_evolve.go implements the genetic-algorithm persona-modulation engine described in arXiv 2507.22171 ("Enhancing Jailbreak Attacks on LLMs via Persona Prompts"). Persona modulation reduces refusal rates by 50–70% per the paper; this engine evolves seed personas via tournament selection, uniform crossover over trait slots, slot mutation, 5% elitism, and periodic immigration to escape mode collapse.

Encoding rationale (struct-of-traits, not string templates) per Promptbreeder (ICLR 2024) and GAAPO (Frontiers AI 2025): string-template crossover produces ungrammatical offspring and converges slowly. The trait dictionary is encoded in templates/genetic_persona_seeds.json with stable slot keys (role / expertise / tone / motivation / constraints / backstory / traits / style / fitness_seed) so uniform crossover over slots always yields a syntactically valid persona.

Per the v0.9.0 plan, persona_evolve requires config.Metadata["allow_experimental"] = "true" because the engine discovers novel jailbreak personas at runtime.

SaltResistance implements anti-salting techniques that counter LLM Salting, a defense that reduces ASR to 3% by adding deployment-specific fine-tuning.

Source: Sophos CAMLIS 2025