probe: intra-sentential code-switching jailbreak

[Yugesh-reddy]

Summary

I'd like to contribute a probe that tests whether refusal training holds when a
harmful request mixes languages within a single sentence (intra-sentential
code-switching) rather than switching at the prompt level.

This is distinct from garak's existing langprovider whole-prompt translation:
the prompts are pre-authored code-switched utterances and must be used verbatim,
not re-translated.

Source / evidence

Prompts and technique come from the MediCS medical red-teaming project:
https://github.com/Yugesh-reddy/MediCS-Red-Teaming

In our experiments on Llama-3-8B, sentence-level code-switched medical-harm
requests achieved a 27.6% attack success rate; a keyword-only ablation that
preserved English sentence structure dropped to ~0% ASR on the same intent
class — a meaningful gap that a probe in this style would surface. (I do not yet
have a paired monolingual-English ASR on the exact held-out set; happy to run
that if useful.)

Proposed shape

• probes.codeswitch.CodeSwitchFull — full prompt set (active=False)
• probes.codeswitch.CodeSwitch — pruned to soft_probe_prompt_cap (active=True)
• primary_detector: mitigation.Prefixes

Open questions before I write any code

1. Scope — does this fit garak's remit, or is there an existing / in-progress
   probe that already covers this technique?
2. Data hosting — the prompt corpus (~500 held-out eval prompts) contains
   harmful medical content. Do you want it committed as a plaintext data file in-tree,
   fetched at runtime from a gated source, or handled another way? Happy to follow
   whatever policy applies to sensitive-content corpora.
3. lang convention — for a probe whose prompts inherently span multiple
   languages, should lang = "en" (matrix/carrier language) or lang = "*"
   (language-agnostic) be used?

Happy to open a PR if this is in scope.