White-box attacks

White-box (also called open-box) attacks use access the other attacks do not: the model’s gradients, logits, hidden states, or attention. The jailbreak is optimized against a local open-weight surrogate you load, then the result is evaluated against your real target. This is the standard optimize-on-surrogate, transfer-to-target workflow, and it finds adversarial suffixes that purely black-box (closed-box) search cannot.

White-box = open-box

We use the established research term white-box (and black-box) for discoverability against the literature. Read it as open-box: the attack needs the model opened up (weights + gradients). The hosted dn/* and bring-your-own API targets stay closed-box - usable only as the transfer target, never as the surrogate.

Requirements

White-box attacks need a local model with gradient access, so install the extra and pass a Hugging Face id or path as attacker_model (the surrogate):

uv add "dreadnode[whitebox]"        # torch + transformers (uv)
pip install "dreadnode[whitebox]"   # torch + transformers (pip)

from dreadnode.airt import gcg_attack

attack = gcg_attack(
    goal="...",
    target=target,                       # closed-box: dn/* or your API (transfer target)
    attacker_model="meta-llama/Llama-2-7b-chat-hf",  # open-box surrogate (local, gradients)
    evaluator_model="dn/claude-opus-4-8",
    n_iterations=50,
)

A hosted dn/* id passed as the surrogate is rejected with a clear message - it cannot provide gradients. A GPU is recommended (7B-scale surrogates need ~80 GB); small models run on CPU for experimentation.

Coordinate-gradient (GCG family)

Optimize a discrete adversarial suffix by greedy coordinate gradient, then transfer the goal + suffix string to the target.

Attack	Idea	Reference
gcg_attack	Greedy Coordinate Gradient suffix search	Zou et al. 2023
faster_gcg_attack	Deterministic greedy + distance regularizer + visited dedup	Li et al. 2024
i_gcg_attack	Multi-coordinate update + easy-to-hard target schedule	Jia et al. ICLR 2025
attngcg_attack	Adds an attention-hijack auxiliary loss	Wang et al. 2024
mask_gcg_attack	Prunes low-impact suffix positions	Mu et al. 2025
arca_attack	Coordinate ascent, one rotating position per step	Jones et al. ICML 2023

Embedding-space

Optimize in the continuous embedding/logit space, then discretize to a transferable suffix.

Attack	Idea	Reference
gbda_attack	Gumbel-softmax distributional optimization	Guo et al. 2021
pez_attack	Gradient descent + nearest-token projection	Wen et al. NeurIPS 2023
cold_attack	Langevin dynamics in logit space (fluent suffixes)	Guo et al. ICML 2024
soft_gcg_attack	Annealed continuous relaxation of GCG	ImprovingGCG

Gradient-free search

Optimize the suffix from the surrogate’s token logits only (no backward pass), then transfer the goal + suffix string to the target.

Attack	Idea	Reference
adaptive_random_search_attack	Random token swaps kept by target loss, with random restarts	Andriushchenko et al. ICLR 2025

Generator

Attack	Idea	Reference
amplegcg_attack	Sample suffixes from a trained generator model	Liao & Sun 2024

Activation / representation (local-only)

These edit or steer the model’s internals and have no transferable text artifact, so they attack - and are judged on - the local open-weight model itself (no transfer target).

Attack	Idea	Reference
refusal_ablation_attack	Erase the refusal direction from the residual stream	Arditi et al. NeurIPS 2024
soft_prompt_attack	PGD on a continuous suffix embedding, generate via inputs_embeds	Schwinn et al. NeurIPS 2024
latentbreak_attack	Word substitution pulling the prompt latent toward harmless prompts	LatentBreak 2025

Tracing

Every step emits a whitebox_step span with dreadnode.airt.whitebox.* attributes (loss, gradient norm, accepted swap, perplexity where relevant) plus access_level, surrogate_model, and optimizer. Transfer trials and findings land exactly as for any other attack, so the Traces and Findings views work unchanged.

Authorized use only

Load surrogate weights you are licensed to use. AmpleGCG generator weights are OPEN-RAIL-M (use-restricted) - pass them explicitly; they are never bundled.