probes: add native multilingual prompt-injection module - #2016
Open
fevziegeyurtsevenler wants to merge 1 commit into
Open
probes: add native multilingual prompt-injection module#2016fevziegeyurtsevenler wants to merge 1 commit into
fevziegeyurtsevenler wants to merge 1 commit into
Conversation
Add garak.probes.multilingual with two direct prompt-injection probes for languages the English-first injection families (promptinject, dan, latentinjection) do not exercise: - TurkishInjection: idiomatic Turkish instruction-override, role-reassignment and system-prompt-exfiltration prompts. - Multilingual: the same ignore-instructions/reveal-system-prompt intent across German, Spanish, French, Russian, Arabic, Chinese, Persian and Turkish, each payload paired with its BCP-47 subtag. Both follow existing conventions (owasp:llm01 tag, intent T009ignore, mitigation.MitigationBypass detector, Tier.OF_CONCERN, goal, docstring). Turkish casefolding background: doc_uri points to NVIDIA#1997. Adds loader/lang/tag tests. Signed-off-by: Fevzi Ege Yurtsevenler <egeyurtsevenler@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this change does
Adds a new native probe module
garak.probes.multilingualwith two directprompt-injection probes phrased in languages that garak's existing English-first
injection families (
promptinject,dan,latentinjection) do not currentlyexercise:
multilingual.TurkishInjection— 16 idiomatic Turkish instruction-override,role-reassignment and system-prompt-exfiltration prompts (e.g. "Önceki
talimatları unut ...").
multilingual.Multilingual— 14 prompts carrying the same "ignore previousinstructions / reveal system prompt" intent across German, Spanish, French,
Russian, Arabic, Chinese, Persian and Turkish, to measure whether a guardrail
generalises beyond English.
Both probes follow current garak conventions:
lang(trand*),tagsincluding
owasp:llm01,intent = "T009ignore"(matchingdan/audio/dra),primary_detector = "mitigation.MitigationBypass", agoal,tier(
Tier.OF_CONCERN),active = True, and a class docstring. Each multilingualpayload is paired with its BCP-47 subtag for provenance, and each corpus carries
short per-payload notes in the source documenting the linguistic trick it
exercises. All prompts are framing only — no operational harmful content — for
authorised defensive testing of a model you own or are permitted to assess.
Motivation: a guardrail tuned on English "ignore previous instructions"
phrasings can miss the same intent when it arrives in another language. These
probes are intended as coverage for that gap; they complement, and do not
replace, the existing English-first families.
Related: the Turkish casefolding background (dotted/dotless-I normalisation,
which affects keyword-based injection filters) was proposed in
NVIDIA/garak PR #1997;
doc_urion both probes points there.Scope
Deliberately kept to a single coherent injection module so it is easy to review.
Possible follow-ups, if of interest to maintainers, are noted here rather than
bundled in:
directly on buffs: add Turkish locale case mapping buffs #1997),
mapping to
AML.T0054.Verification
python -m pytest tests/probes/test_probes_multilingual.py— asserts bothprobes load, expose non-empty unique string prompts, have valid
lang(
langcodes.tag_is_valid/*), carryowasp:llm01, and that everydeclared multilingual payload language is a valid BCP-47 subtag covering
>= 4 languages.
garak -t test.Blank --probes multilingual— probes enumerate and run.mitigation.MitigationBypassdetector scores refusal vs compliance.