farouk1/redteam
1
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

finito

Browse Source
This commit is contained in:
Farouk Adeleke
2025-10-21 14:25:13 -04:00
parent 7b1535f925
commit 1e87c64fe1
1 changed files with 10 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
README.md
View File

@@ -3,16 +3,7 @@
A packaged version of an open source red-teaming framework that uses the power of [DSPy](https://github.com/stanfordnlp/dspy) to red-team language models through automated attack generation and optimization. A packaged version of an open source red-teaming framework that uses the power of [DSPy](https://github.com/stanfordnlp/dspy) to red-team language models through automated attack generation and optimization.
## Quick Start ## Quick Start
Run this agent within a new project:
### Installation
```bash
git clone https://git.modaic.dev/farouk1/redteam.git
cd redteam
uv sync
```
Or initialize a new project:
```bash ```bash
uv init uv init
@@ -87,7 +78,7 @@ if __name__ == "__main__":
### Configuration ### Configuration
The red-team agent can be configured via the `config_options` parameter: The red-team agent can be configured via the `config_options` parameter in `AutoAgent.from_precompiled`:
```python ```python
class RedTeamConfig(PrecompiledConfig): class RedTeamConfig(PrecompiledConfig):
@@ -98,27 +89,29 @@ class RedTeamConfig(PrecompiledConfig):
temperature: float = 0 temperature: float = 0
``` ```
### Installation
```bash
git clone https://git.modaic.dev/farouk1/redteam.git
cd redteam
uv sync
```
## Overview ## Overview
To our knowledge, this is the first attempt at using any auto-prompting *framework* to perform the red-teaming task. This is also probably the deepest architecture in public optimized with DSPy to date. To our knowledge, this is the first attempt at using any auto-prompting *framework* to perform the red-teaming task. This is also probably the deepest architecture in public optimized with DSPy to date.
We accomplish this using a *deep* language program with several layers of alternating `Attack` and `Refine` modules in the following optimization loop: We accomplish this using a *deep* language program with several layers of alternating `Attack` and `Refine` modules in the following optimization loop:
![Overview of DSPy for red-teaming](https://cdn.prod.website-files.com/66f89b6eb96e685709a53e09/6783565e10c519704c177998_DSPy-Redteam.png) ![Overview of DSPy for red-teaming](https://cdn.prod.website-files.com/66f89b6eb96e685709a53e09/6783565e10c519704c177998_DSPy-Redteam.png)
*Figure 1: Overview of DSPy for red-teaming. The DSPy MIPRO optimizer, guided by a LLM as a judge, compiles our language program into an effective red-teamer against Vicuna.* *Figure 1: Overview of DSPy for red-teaming. The DSPy MIPRO optimizer, guided by a LLM as a judge, compiles our language program into an effective red-teamer against Vicuna.*
The following Table demonstrates the effectiveness of the chosen architecture, as well as the benefit of DSPy compilation: The following Table demonstrates the effectiveness of the chosen architecture, as well as the benefit of DSPy compilation:
![Results](https://cdn.prod.website-files.com/66f89b6eb96e685709a53e09/678357036bff3a56f1161706_678356ec1f1cbdbead37e11d_Screenshot%25202025-01-12%2520at%252012.45.10%25E2%2580%25AFAM.png) ![Results](https://cdn.prod.website-files.com/66f89b6eb96e685709a53e09/678357036bff3a56f1161706_678356ec1f1cbdbead37e11d_Screenshot%25202025-01-12%2520at%252012.45.10%25E2%2580%25AFAM.png)
*Table 1: ASR with raw harmful inputs, un-optimized architecture, and architecture post DSPy compilation.* *Table 1: ASR with raw harmful inputs, un-optimized architecture, and architecture post DSPy compilation.*
With *no specific prompt engineering*, we are able to achieve an Attack Success Rate of 44%, 4x over the baseline. This is by no means the SOTA, but considering how we essentially spent no effort designing the architecture and prompts, and considering how we just used an off-the-shelf optimizer with almost no hyperparameter tuning (except to fit compute constraints), we think it is pretty exciting that we can achieve this result! With *no specific prompt engineering*, we are able to achieve an Attack Success Rate of 44%, 4x over the baseline. This is by no means the SOTA, but considering how we essentially spent no effort designing the architecture and prompts, and considering how we just used an off-the-shelf optimizer with almost no hyperparameter tuning (except to fit compute constraints), we think it is pretty exciting that we can achieve this result!