Transforms

Adversarial transforms that mutate an attack prompt - encoding, ciphers, persuasion, injection, agentic, training, and multimodal techniques - usable with any attack.

A transform rewrites an attack prompt into a different representation so the same goal can be tried many ways. They compose with any attack, and the library is broad (500+ transforms across text, agentic, training, and multimodal surfaces) so you can probe a wide range of model and agent behaviors from one goal.

What is a transform?

A transform converts a prompt from one representation to another. The goal is to find blindspots in post-safety-training alignment: the same harmful request may be refused in plain English but accepted when encoded in Base64, rephrased in another language, wrapped in a role-play scenario, or embedded inside a code comment.

Models are most likely safety-aligned primarily on English text in standard formatting, so transforms probe the representations where that alignment tends to be weaker:

Encoding and ciphers - Base64, hex, ROT13, Morse code, Braille. If the model can decode these formats, it may follow instructions it would refuse in plaintext.
Multilingual and script probing - rephrase the attack into another language via LLM-driven adaptation, or transliterate it into a non-Latin script (Cyrillic, Arabic, Katakana, Hangul, Devanagari). Safety data is sparser outside high-resource English, so a request refused in English may be accepted elsewhere. (Languages are not a fixed list - you supply the target language.)
Persuasion and social engineering - authority appeals, emotional framing, urgency, reciprocity. Tests whether the model’s post-safety-training alignment holds under psychological pressure.
Injection and framing - skeleton key, many-shot examples, positional wrapping. Tests whether framing the request differently bypasses intent detection.
Agentic and tool attacks - MCP tool poisoning, multi-agent trust exploits, delegation hijacking. Tests whether agent infrastructure can be manipulated.
Multimodal perturbation - image, audio, and video transforms: noise and corruptions, steganography, typographic attacks, inaudible carriers, and temporal video manipulations. See Image, Audio, and Video transforms.

By running the same attack goal through multiple transforms, you build a map of where the model’s defenses hold and where they break. A model that refuses the raw prompt but complies after Base64 encoding has a safety gap that needs to be closed.

Using transforms

Use transforms with any attack via the transforms parameter.

# CLI: stack transforms with --transform
dn airt run --goal "..." --attack tap --transform base64 --transform leetspeak

# SDK: pass a list of transform instances
from dreadnode.airt import tap_attack
from dreadnode.transforms.encoding import base64_encode
from dreadnode.transforms.persuasion import authority_appeal

attack = tap_attack(
    goal="...",
    target=target,
    attacker_model="dn/claude-opus-4-8",
    evaluator_model="dn/claude-opus-4-8",
    transforms=[base64_encode(), authority_appeal()],
)

From the TUI, ask the AI red teaming agent in natural language - it maps the request onto the same attack and transforms:

Run a TAP attack on my target for "<goal>", applying the base64 and authority_appeal transforms.

Transforms

What is a transform?

Using transforms

Categories

Text-based

Agentic

Training and supply chain

Multimodal

More