superred-optimizer-tap

A Tree of Attacks with Pruning (TAP) jailbreak optimizer for the superred red-teaming framework.

TAP treats jailbreaking as a tree search. An attacker LLM proposes candidate prompts, off-topic ones are pruned away, every surviving prompt is sent to the real target, and each prompt/response pair is scored 1–10. The best branches are kept and expanded again, deepening the tree until a prompt scores a full 10 or the maximum depth is reached.

Reference: Mehrotra et al., "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically," arXiv:2312.02119 (NeurIPS 2024). Official implementation: RICommunity/TAP (MIT License). See ASSUMPTIONS.md for the full paper-to-code mapping and every deliberate departure.

Install

pip install superred-optimizer-tap

Usage

from tap_optimizer import TapOptimizer

# Paper-aligned defaults (branching_factor=1, tree_width=10, tree_depth=10, ...).
optimizer = TapOptimizer()

# Reproduce a specific TAP experiment by setting the target opening string.
optimizer = TapOptimizer(target_str="Sure, here is", tree_depth=8)

Wire it into a Controller like any other superred optimizer — see the framework's architecture overview and a target's README (e.g. superred-target-chatbot) for a full Controller.run() example.

License

MIT for this port's code (see LICENSE). The upstream reference implementation, RICommunity/TAP, is MIT licensed. This port reimplements the TAP search and prompts against superred's event model rather than vendoring upstream source files.