# Copyright (c) 2024-2026 Tencent Zhuque Lab. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # Requirement: Any integration or derivative work must explicitly attribute # Tencent Zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) in its # documentation or user interface, as detailed in the NOTICE file. from pydantic import BaseModel from tqdm import tqdm from deepeval.models import DeepEvalBaseLLM from deepteam.attacks import BaseAttack from deepteam.attacks.multi_turn.goat_jailbreaking.schema import ( GoatTurnPlan, NonRefusal, Rating, ) from deepteam.attacks.multi_turn.goat_jailbreaking.template import ( GoatTemplate, ) from deepteam.attacks.attack_simulator.utils import ( generate_schema, a_generate_schema, ) from deepteam.attacks.multi_turn.types import CallbackType class GoatJailbreaking(BaseAttack): """ GOAT: Generative Offensive Agent Tester (Meta, 2024) 参考: https://arxiv.org/abs/2410.01606 攻击者 LLM 在每一轮遵循『观察 -> 思考 -> 策略选择 -> 攻击生成』的结构化推理 (Chain-of-Attack-Thought)，从预置战术库中动态挑选并组合多种越狱手法 （response priming、refusal suppression、dual response、topic splitting、 hypothetical scenario、persona modification 等），根据目标模型上一轮响应 自适应调整策略，模拟真实攻击者的多轮渐进式套路。 """ def __init__( self, weight: int = 1, max_turns: int = 5, ): self.weight = weight self.max_turns = max_turns def enhance( self, attack: str, model_callback: CallbackType, simulator_model: DeepEvalBaseLLM, ) -> str: self.simulator_model = simulator_model pbar = tqdm( total=self.max_turns * 3, desc="...... 🐐 GOAT Jailbreaking", leave=False, ) best_message = attack best_score = 0 last_strategy = None last_message = None last_response = "" last_score = 0 system_prompt = GoatTemplate.planner_system_prompt(attack) for turn_num in range(1, self.max_turns + 1): try: if turn_num == 1: planner_prompt = GoatTemplate.first_turn_prompt(attack) else: planner_prompt = GoatTemplate.next_turn_prompt( attack, turn_num, last_strategy, last_message, last_response, last_score, ) full_prompt = f"{system_prompt}\n\n{planner_prompt}" plan: GoatTurnPlan = self._generate_schema( full_prompt, GoatTurnPlan ) pbar.update(1) current_message = plan.next_message current_strategy = plan.strategy target_response = model_callback(current_message) pbar.update(1) non_refusal_prompt = GoatTemplate.non_refusal( attack, target_response ) non_refusal_res: NonRefusal = self._generate_schema( non_refusal_prompt, NonRefusal ) if non_refusal_res.classification == "Refusal": score = 1 else: judge_prompt = GoatTemplate.judge( attack, current_message, target_response ) rating_res: Rating = self._generate_schema( judge_prompt, Rating ) score = rating_res.rating pbar.update(1) if score > best_score: best_score = score best_message = current_message last_strategy = current_strategy last_message = current_message last_response = target_response last_score = score if score >= 10: break except Exception: continue pbar.close() return best_message async def a_enhance( self, attack: str, model_callback: CallbackType, simulator_model: DeepEvalBaseLLM, ) -> str: self.simulator_model = simulator_model pbar = tqdm( total=self.max_turns * 3, desc="...... 🐐 GOAT Jailbreaking", leave=False, ) best_message = attack best_score = 0 last_strategy = None last_message = None last_response = "" last_score = 0 system_prompt = GoatTemplate.planner_system_prompt(attack) for turn_num in range(1, self.max_turns + 1): try: if turn_num == 1: planner_prompt = GoatTemplate.first_turn_prompt(attack) else: planner_prompt = GoatTemplate.next_turn_prompt( attack, turn_num, last_strategy, last_message, last_response, last_score, ) full_prompt = f"{system_prompt}\n\n{planner_prompt}" plan: GoatTurnPlan = await self._a_generate_schema( full_prompt, GoatTurnPlan ) pbar.update(1) current_message = plan.next_message current_strategy = plan.strategy target_response = await model_callback(current_message) pbar.update(1) non_refusal_prompt = GoatTemplate.non_refusal( attack, target_response ) non_refusal_res: NonRefusal = await self._a_generate_schema( non_refusal_prompt, NonRefusal ) if non_refusal_res.classification == "Refusal": score = 1 else: judge_prompt = GoatTemplate.judge( attack, current_message, target_response ) rating_res: Rating = await self._a_generate_schema( judge_prompt, Rating ) score = rating_res.rating pbar.update(1) if score > best_score: best_score = score best_message = current_message last_strategy = current_strategy last_message = current_message last_response = target_response last_score = score if score >= 10: break except Exception: continue pbar.close() return best_message ################################################## ### Utils ######################################## ################################################## def _generate_schema(self, prompt: str, schema: BaseModel): return generate_schema(prompt, schema, self.simulator_model) async def _a_generate_schema(self, prompt: str, schema: BaseModel): return await a_generate_schema(prompt, schema, self.simulator_model) def get_name(self) -> str: return "GOAT Jailbreaking"