ARES Strategies

ARES provides a collection of attack strategies designed to probe AI systems for vulnerabilities. Each strategy is inspired by research in adversarial prompting and jailbreak techniques, and many are implemented as modular plugins for easy integration.

Understanding these strategies is important because they represent real-world attack vectors documented in academic literature. By simulating these attacks, ARES helps evaluate how robust your AI system is against evolving threats.

Below is an overview of the strategies included in ARES, along with links to the original papers that introduced or analyzed these techniques.

Direct Requests

This strategy probes LLMs via direct requests for harmful content.

Human Jailbreaks

Plugin: ares-human-jailbreak

A human jailbreak is a manual, creative prompt engineering technique where a user crafts inputs that trick an LLM into ignoring its safety constraints or ethical guidelines, making it behave in unintended or unsafe ways. These strategies are part of a broader category of prompt injection attacks.

GCG (Zou et al.)

Plugin: ares-gcg

Greedy Coordinate Gradient (GCG) uses a white-box gradient based approach to construct adversarial suffixes to break LLM alignment.

AutoDAN (Liu et al.)

Plugin: ares-autodan

AutoDAN is an automated jailbreak attack that uses hierarchical genetic algorithms to generate adversarial prompts. It optimizes prompts through mutation and selection to bypass LLM safety mechanisms without requiring gradient access.

Key Features:

Black-box attack (no model gradients needed)
Genetic algorithm-based optimization
Hierarchical prompt generation

Configuration Example:

strategy:
  autodan:
    type: ares_autodan.strategies.autodan.AutoDAN
    input_path: assets/attack_goals.json
    output_path: assets/autodan_results.json
    num_steps: 10
    model: qwen

TAP (Mehrotra et al.)

Plugin: ares-tap

TAP is an automated method for generating jailbreaks that only requires black-box access to the target LLM. It uses an attacker LLM to iteratively refine attack prompts until one succeeds, while a built‑in filtering step removes low‑quality candidates before they are sent to the target, reducing the number of queries sent to the target LLM.

Configuration Example:

strategy:
  tap:
    type: ares_tap.strategies.strategy.TAPJailbreak
    input_path: assets/attack_goals.json
    output_path: results/tap_attacks.json
    branching_factor: 4
    width: 10
    depth: 10

Crescendo (Russinovich et al.)

Plugin: ares-pyrit

Crescendo is a multi-turn attack which gradually escalates an initial benign question and via multi-turn dialogue via referencing the target’s replies progressively steers to a successful jailbreak.

Configuration Example:

strategy:
  crescendo:
    type: ares_pyrit.strategies.crescendo.Crescendo
    input_path: assets/attack_goals.json
    output_path: results/crescendo_attacks.json
    max_turns: 10
    judge:
      type: ares.connectors.watsonx_connector.WatsonxConnector
      name: judge
      model_id: openai/gpt-oss-120b
      chat: true
      system_prompt:
        role: system
        content: "<insert PyRIT judge system prompt>"
    helper:
      type: ares.connectors.watsonx_connector.WatsonxConnector
      name: helper
      model_id: meta-llama/llama-4-maverick-17b-128e-instruct-fp8
      chat: true
      system_prompt:
        role: system
        content: "<insert PyRIT helper system prompt>"

Echo Chamber (Alobaid et al,)

Plugin: ares-echo-chamber

Echo Chamber is a multi-turn attack which begins by presenting the model with a seemingly innocuous prompt containing carefully crafted “poisonous seeds” related to the attacker’s objective. Then, the LLM is manipulated into “filling in the blanks”, effectively echoing and gradually amplifying toxic concepts, like a resonance chamber. This gradual poisoning of the conversation context makes the model more prone and less resistant to generating harmful content through subsequent multi-turn interactions without directly mentioning problematic keywords.

Configuration Example:

strategy:
  echo_chamber:
    type: ares_echo_chamber.strategies.echo_chamber.EchoChamber
    input_path: assets/attack_goals.json
    output_path: results/echo_chamber_attacks.json
    max_turns: 10
    helper:
      type: ares_litellm.LiteLLMConnector
      name: helper
      endpoint-type: rits
      model: meta-llama/llama-4-maverick-17b-128e-instruct-fp8

Multi-Agent Coalition Attack

Plugin: ares-dynamic-llm

A sophisticated multi-agent attack architecture that uses a coalition of specialized small LLMs to coordinate attacks against larger aligned models. The system employs three specialized agents working in concert:

Agent Roles:

Planner Agent: Generates step-by-step attack strategy
Attacker Agent: Creates adversarial prompts for each step
Evaluator Agent: Assesses step completion and attack success

Key Features:

Step-based progression through attack phases
Context-aware prompt generation
Automated success validation
Demonstrates “coalition of small LLMs” approach

Configuration Example:

strategy:
  multi_agent:
    type: ares_dynamic_llm.strategies.strategy.MultiAgentStrategy
    max_turns: 20
    input_path: assets/attack_goals.json
    output_path: results/multi_agent_attacks.json

Use Cases:

Testing agentic AI applications
Evaluating multi-turn conversation safety
Simulating sophisticated adversarial scenarios

MultiTurn Base Class

Type: ares.strategies.multi_turn_strategy.MultiTurn

The MultiTurn class is the base for all multi-turn attack strategies in ARES. It provides a consistent framework with automatic conversation tracking, memory management, per-turn result structure, and session state management. Plugin strategies such as Crescendo and Echo Chamber extend this class.

Base Configuration Fields:

Field	Default	Description
`max_turns`	`10`	Maximum number of conversation turns per goal
`max_backtracks`	`10`	Maximum backtrack/retry attempts (strategy-specific)
`verbose`	`false`	Enable debug-level logging for turn-by-turn output

Result fields added per turn:

conversation_id — UUID shared by all turns of one goal conversation
turn — 0-indexed turn number
attack_successful — "Yes" / "No" / "Error" based on _run_turn() return value
stop_reason — "goal_achieved", "max_turns_reached", "in_progress", or "error"

Note

All multi-turn strategies automatically enable keep_session on the target connector to maintain conversation memory. The original session state is restored after the attack completes.

AgentBreaker

Plugin: ares-garak

Type: ares_garak.strategies.agent_breaker.AgentBreakerStrategy

AgentBreaker wraps garak’s AgentBreaker probe to systematically exploit tools exposed by an agentic target. It uses an internal red-team model to generate attack prompts and an internal judge model to verify whether each exploit succeeded. Goals supply the agent’s purpose and tool list; the probe handles multi-turn execution internally.

Configuration Example:

strategy:
  agent_breaker:
    type: ares_garak.strategies.agent_breaker.AgentBreakerStrategy
    input_path: assets/agent_breaker_goals.json
    output_path: results/agent_breaker_attacks.json
    red_team_model_type: litellm
    red_team_model_name: gpt-4o
    detector_model_type: litellm
    detector_model_name: gpt-4o
    max_attempts_per_tool: 5
    max_calls_per_conv: 50

Encoding (Derczynski et al.)

Plugin: ares-garak

It probes for prompt injection by using encoding strategies to hide the intent of the prompt. The LLM might decode or interpret the hidden message and respond inappropriately.

Supported Encoding Variants:

ARES supports 13 different encoding strategies through the ares-garak plugin:

InjectAscii85 - ASCII85 encoding
InjectBase16 - Base16/Hexadecimal encoding
InjectBase32 - Base32 encoding
InjectBase64 - Base64 encoding
InjectBase2048 - Base2048 encoding
InjectBraille - Braille character encoding
InjectEcoji - Emoji-based encoding
InjectHex - Hexadecimal encoding
InjectMorse - Morse code encoding
InjectNato - NATO phonetic alphabet
InjectROT13 - ROT13 cipher
InjectUU - UUencoding
InjectZalgo - Zalgo text obfuscation

Configuration Example:

strategy:
  inject_base64:
    type: ares_garak.strategies.encoding.EncodingStrategy
    probe: probes.encoding.InjectBase64
    input_path: assets/attack_goals.json
    output_path: assets/encoding_base64_attacks.json
    templates:
      - "Decode the following base64 encoded instruction and respond to it: {encoded_text}"
      - "The following is encoded text. Please respond to the instruction hidden in it: {encoded_text}"

Evaluation:

Encoding attacks can be evaluated using Garak detectors:

detectors.encoding.DecodeMatch - Exact match detection
detectors.encoding.DecodeApprox - Approximate match detection