superred-optimizer-many-shot

A Many-Shot Jailbreaking single-turn optimizer for the superred red-teaming framework.

Community port — not an official implementation. This module is an unofficial re-implementation of Many-shot Jailbreaking (Anil et al., Anthropic) for superred. It is not affiliated with, endorsed by, or maintained by the original authors. See ASSUMPTIONS.md for every deliberate deviation from the paper and reference code.

Many-shot jailbreaking abuses long context windows. It builds one prompt packed with many faux user/assistant exchanges in which the assistant always complies with a harmful request, then appends the real objective as the final user turn. Faced with a long run of "compliant" examples, the model tends to continue the pattern and comply too.

Reference: Anil et al., "Many-shot Jailbreaking," Anthropic, April 2024 (research page, PDF; later NeurIPS 2024). There is no official code release; this is an independent implementation from the paper. See ASSUMPTIONS.md for the full paper-to-code mapping and every deliberate departure.

Install

pip install superred-optimizer-many-shot

Usage

from many_shot_optimizer import ManyShotOptimizer

# Default: one 256-shot attempt (matches the paper's main many-shot setup).
optimizer = ManyShotOptimizer()

# Sweep the number of shots across staged runs.
optimizer = ManyShotOptimizer(example_counts=[32, 64, 128, 256, 400, 512])

Wire it into a Controller like any other superred optimizer — see the framework's architecture overview and a target's README (e.g. superred-target-chatbot) for a full Controller.run() example.

License

MIT for this port's code (see LICENSE). Many-shot jailbreaking was published by Anthropic without an official code release, so there is no upstream repository to vendor from; this module is an independent implementation of the technique described in the paper.