FEAT Add Best-of-N jailbreak (converter + attack)

[francose]

hey.. wanted to float this before a PR since the workflow here is agree on a plan first.

proposing Best-of-N jailbreak (Hughes et al. 2024, arXiv:2412.03556) as a converter + a single-turn attack. i checked the tree and theres no BoN anywhere... not in the converters, not in the attack strategies.

the idea is dead simple and thats the point.. take the objective, apply a stochastic text augmentation (intra-word scramble + random capitalization + ascii noise), send it, score it, and keep re-sampling fresh augmentations until one slips past the safety training or you hit the sample budget N. ASR climbs with N. black-box, text-only.

shape:

• BestOfNConverter — the augmentation. one sigma knob, power-scaled the way the reference impl does (scramble/case at sigma**0.5, noise at sigma**3) so the default reproduces the paper's ~0.6/0.6/0.06 rates instead of one flat rate. fresh randomness per call, so reapplying gives you the N distinct samples.
• BestOfNAttack — thin PromptSendingAttack subclass, same pattern as FlipAttack/ManyShot. prepends the converter and maps n_samples onto the retry budget, so the existing retry loop IS the sample-until-break loop. no bespoke machinery.

paper is multimodal but this is text-only... thats the core attack and it composes cleanly with the converter stack. audio/image BoN could be a follow-up.

its written and green locally — converter + attack + tests (including an end-to-end one proving distinct augmentations actually reach the target across attempts) + bib entry + a converters-notebook example. passes ruff and the doc gate. holding the PR til you confirm you want it and the shape's right (own converter+attack vs folding into something existing). thoughts?

[romanlutz]

I would suggest you outline an implementation plan first since the "augmentations" sound a lot like converters themselves.

I'm fine with including this provided it actually works. I suppose the paper has data on that (haven't read it yet) but we should also empirically verify. Whichever combinations of converters turn out to be useful should be added as a technique.

[francose]

Sounds good I ll try to come up with a plan and propose

[francose]

here s my plan lmk what you think

the three augmentations are converters, and two already exist: CharSwapConverter (scramble) and RandomCapitalLettersConverter (caps). only the ascii-noise one is missing, and thats small, a cheap +/-1 char perturbation.

so no monolithic converter. BoN is the attack: stack those three and re-sample N times til the objective scorer flips. the retry loop already re-draws converters each attempt so it IS the sampling. thin PromptSendingAttack subclass like FlipAttack.

ill put the three behind one strength dial so it works without hand-tuning, and run it against a live target to show ASR climbing with N before the PR.

[romanlutz]

We actually migrated flip attack to no longer be an attack but a technique in #2178 . Techniques are the abstraction level at which you have the fully composed thing you want to run while attacks are just a piece of logic you wouldn't be able to do with the basic components.

This may help: https://microsoft.github.io/PyRIT/latest/code/framework/#architecture

So the three converters (or rather 2 existing + 1 new) make sense. I think you are right in that this requires an attack to put the logic together since it's iterative (not just a broad sweep of various converter combinations). Feel free to propose a PR.

[Yusup-Badiev]

Hi @francose lmk if you would like any more hands to support this. I use Best-of-N jailbreak for testing and wanted a simple interface to test it with.

[francose]

hey @Yusup-Badiev, appreciate the offer. i've got a branch pretty much ready, thin PromptSendingAttack subclass with the three augmentations behind one strength dial plus a small ascii-noise converter.

since the build's basically done the thing that'd actually help is testing. if you run BoN on your own targets, would be great to have you try the branch once the PR's up and see if ASR climbs with N the way it should. i'll tag you when it's open.

[romanlutz]

To add to what @francose wrote: it's not obvious to me why it should be exactly those converters and not others. Any experiments that show meaningful improvements would be potentially impactful.