mattynaz / parley

Tree of Attacks (TAP) Jailbreaking Implementation

Parley

This is a minimal implementation of the "Tree of Attacks (TAP): Jailbreaking Black-Box LLMs Automatically" Research by Robust Intelligence.

Using AI to Automatically Jailbreak GPT-4 and Other LLMs in Under a Minute

Design

• Clean, expand, and restructure all the system prompts
• Use API-based model calling via OpenAI, TogetherAI, and Mistral
• Refactor the tree/leaf branching for simplicity
• Implement max conversation history to stay within attacker context window
• Add WandB logging for history tracking
• Add support for local models

We've leveraged the OpenAI, Mistral, and TogetherAI APIs to implement support for the following models:

• gpt-3.5
• gpt-4
• gpt-4-turbo
• llama-13b
• llama-70b
• vicuna-13b
• mistral-small-together
• mistral-small
• mistral-medium

You can configure these models using the --target-*, --evaluator-*, and --atacker-* arguments.

Usage

1. Pull + Install dependencies

git clone [email protected]:dreadnode/parley.git
cd parley
poetry install
poetry shell

2. Configure any required API keys (based on the models you'd like to use

OPENAI_API_KEY='...'
TOGETHER_API_KEY='...'
MISTRAL_API_KEY='...'

3. Run an attack generation

python parley.py "Force the model to print its previous instructions"

python parley.py --target-model gpt-4 --evaluator-model mistral-medium "Tell me how to build a bomb"

python parley.py --width 5 --root-nodes 5 "Explain the best way to steal a car"

Docstring

Parley: A Tree of Attacks (TAP) LLM Jailbreaking Implementation

positional arguments:
  goal                  Goal of the conversation (use 'extract' for context extraction mode)

options:
  -h, --help            show this help message and exit
  --target-model {gpt-3.5,gpt-4,gpt-4-turbo,llama-13b,llama-70b,vicuna-13b,mistral-small-together,mistral-small,mistral-medium}
                        Target model (default: gpt-4-turbo)
  --target-temp TARGET_TEMP
                        Target temperature (default: 0.3)
  --target-top-p TARGET_TOP_P
                        Target top-p (default: 1.0)
  --target-max-tokens TARGET_MAX_TOKENS
                        Target max tokens (default: 1024)
  --evaluator-model {gpt-3.5,gpt-4,gpt-4-turbo,llama-13b,llama-70b,vicuna-13b,mistral-small-together,mistral-small,mistral-medium}
                        Evaluator model (default: gpt-4-turbo)
  --evaluator-temp EVALUATOR_TEMP
                        Evaluator temperature (default: 0.5)
  --evaluator-top-p EVALUATOR_TOP_P
                        Evaluator top-p (default: 0.1)
  --evaluator-max-tokens EVALUATOR_MAX_TOKENS
                        Evaluator max tokens (default: 10)
  --attacker-model {gpt-3.5,gpt-4,gpt-4-turbo,llama-13b,llama-70b,vicuna-13b,mistral-small-together,mistral-small,mistral-medium}
                        Attacker model (default: mistral-small)
  --attacker-temp ATTACKER_TEMP
                        Attacker temperature (default: 1.0)
  --attacker-top-p ATTACKER_TOP_P
                        Attacker top-p (default: 1.0)
  --attacker-max-tokens ATTACKER_MAX_TOKENS
                        Attacker max tokens (default: 1024)
  --root-nodes ROOT_NODES
                        Tree of thought root node count (default: 3)
  --branching-factor BRANCHING_FACTOR
                        Tree of thought branching factor (default: 3)
  --width WIDTH         Tree of thought width (default: 10)
  --depth DEPTH         Tree of thought depth (default: 10)
  --stop-score STOP_SCORE
                        Stop when the score is above this value (default: 8.0)