Attacks Reference

An adversarial attack is a systematic search for inputs that make an AI system violate its intended behavior: a jailbreak that bypasses safety alignment, a perturbation that flips a classifier’s prediction, or an injection that hijacks an agent’s actions. Each attack is an optimization loop that iterates against the target and scores how far it moved that behavior.

Dreadnode AI red teaming provides 100+ adversarial attacks. They split into two families:

Generative AI attacksJailbreaks, advanced adversarial algorithms, agent attacks, and multimodal probing for LLMs, agents, and AI applications.

Traditional ML attacksEvasion, model extraction, membership inference, model inversion, and image adversarial attacks against black-box ML classifiers.

Quick reference

Category	Attacks	Best for
Core jailbreak	TAP, PAIR, GOAT, Crescendo, Rainbow, GPTFuzzer, BEAST, AutoDAN, ReNeLLM, DrAttack, Deep Inception, Prompt	General-purpose jailbreak testing
Advanced adversarial	AutoRedTeamer, NEXUS, Siren, CoT Jailbreak, Genetic Persona, JBFuzz, T-MAP, APRT, and 21 more	Stronger targets, specialized techniques
White-box (open-box)	GCG, Faster-GCG, I-GCG, AttnGCG, Mask-GCG, ARCA, GBDA, PEZ, COLD, Soft-GCG, AmpleGCG, refusal ablation, soft-prompt, LatentBreak	Open-weight surrogates, transfer to your target
Agent attacks	IterInject, AgentVigil, EVA	Tool-using, RAG, and GUI/computer-use agents
Multimodal	Multimodal Attack	Cross-modality probing
Evasion	HopSkipJump, SimBA, Square, ZOO, TextFooler, and more	Flipping a classifier’s prediction
Extraction	Knockoff, Copycat, ActiveThief, Jacobian, and more	Stealing a surrogate copy of a model
Membership inference	LiRA, shadow-model, loss/entropy threshold, label-only	Detecting training-set membership
Model inversion	MI-Face, NES inversion	Reconstructing training inputs
Image adversarial	SimBA, NES, ZOO, HopSkipJump	Vision model robustness

Probing agents

For tool-using, RAG, and multi-agent targets, start with the agent attacks (IterInject, AgentVigil, EVA) and the Agentic Red Teaming and Red Teaming an Agent guides.

Choosing an attack

By compute budget

Budget	Queries	Recommended attacks
Minimal	~50	deep_inception + renellm
Moderate	~500	tap + pair + crescendo
Standard	~500-1000	Above + autoredteamer, refusal_aware, cot_jailbreak, persona_hijack
Extensive	~2000+	Full campaign: tap, pair, crescendo, goat, goat_v2, autoredteamer, rainbow, jbfuzz

By target characteristics

Situation	Recommended attack
First test, general purpose	tap
Fast black-box jailbreak	pair
Model resists single-turn attacks	crescendo
Want diverse failure modes	rainbow
Large-scale fuzzing	gptfuzzer
Keyword-filtered target	drattack
Role-play susceptible target	deep_inception
Suffix robustness testing	beast
Reasoning model (o1, o3)	cot_jailbreak
Strong target, need adaptive strategy	autoredteamer
Models with predictable refusals	refusal_aware
Progressive multi-phase assessment	aprt_progressive
Vision model	simba, nes, zoo, or hopskipjump

By known defenses

Defense	Effective attacks
Strong system prompt	crescendo, deep_inception, drattack
Output classifier	beast, autodan_turbo, renellm, guardrail bypass transforms
Rate limiting	pair (most query-efficient), deep_inception
Input sanitization	beast, drattack, encoding transforms
Tool-call filtering	Agentic workflow transforms
Content moderation	Guardrail bypass transforms
Conversation monitoring	crescendo, reasoning attack transforms

Tip

Start with tap or goat. If those don’t work, try crescendo for multi-turn escalation, autoredteamer for adaptive strategy learning, or rainbow to discover what kind of attacks the target is weak against.