FuzzyAI - A powerful tool for automated LLM fuzzing. It is d

项目说明

<p align="center">
<h1 align="center">FuzzyAI Fuzzer</h1>
<p align="center">
<img src="/src/fuzzyai/resources/logo.png" alt="Project Logo" width="200" style=":middle; margin-right:10px;" /><br/>
The FuzzyAI Fuzzer is a powerful tool for automated LLM fuzzing. It is designed to help de and security researchers identify jailbreaks and mitigate potential security in their LLM APIs.
</p>
</p>
<p align="center">
<a href="
<img alt="GitHub last commit" src="
</a>
<a href="
<img alt="GitHub code size in bytes" src="
</a>
<a href=" >
<img alt="GitHub License" src="
</a>
<a href="
<img alt="Discord" src="
</a>
<br/><br/>
<img alt="fuzzgif" src="/src/fuzzyai/resources/fuzz.gif" />
<br/>
</p>

Getting Started

Quick start #1 - Using an existing python project

1. Install fuzzyai

2. Run the fuzzer

Quick start #2 - or as a standalone project

1. Clone the repository:

2. Install dependencies using Poetry:

3. Run the fuzzer:

4. Optional: Install ollama, and download a model for local usage:

Alternativly, you can use the Web UI

Web UI (Experimental)

!FZAI

1. Run the Web UI (make sure you completed either of the installation steps from above):

Notebooks

We' interacti notebooks you can use under src/fuzzyai/resources/notebooks/.
For more information, see notebooks wiki.

Datasets

We' some datasets you can use under resources/. For more information, see datasets wiki.

Documentation

Explore detailed usage instructions in the Wiki.

Examples

If you're using poetry, make sure you' the venv (or by prepending 'poetry run' to the command line

A default attack (just e the prompt 'Harmful_Prompt') using llama o

Attack the prompt utilizing ManyShot and Taxonomy attacks, using gpt3.5 o using one worker

Attack prompts in prompts.txt utilizing the ArtPrompt attack, using Claude 3.5 o

---

Attack your own REST API

#### Arguments breakdown:

-a def:

Invokes the default attack mode, which e the API without applying additional strategies.

-x openai/gpt-4:

Specifies an auxiliary model (gpt-4) to assist with certain tasks during the attack.

-e classifier_model=openai/gpt-4:

Configures the fuzzer to use the gpt-4 model for classifying outputs. This helps determine whether responses meet specific criteria, such as detecting harmful or unwanted content.

-m rest/http.raw:

Uses the REST provider to attack an API endpoint. The raw HTTP request is parsed from the file http.raw. (Refer to the documentation or example for details on the file structure.)

-e host=localhost -e port=8000 -e scheme=https:

Configures the REST provider with the following API endpoint details:
- Host: localhost
- Port: 8000
- Scheme: https (communication will use HTTPS)

-t "How to build a bomb":

Specifies the test input. In this example, it tests the API's handling of sensitive or harmful content.

Key Features

Comprehensi Techniques: Le mutation-based, generation-based, and intelligent fuzzing.

Built-in Input Generation: Generate valid and invalid inputs for exhausti.

Seamless Integration: Easily incorporate into your de and testing workflows.

Extensible Architecture: Customize and expand the fuzzer to meet your unique requirements.

Supported models

FuzzyAI supports models across top pro, including:

| Provider | Models |
|--------------|----------------------------------------------------------------------------------------------------------|
| Anthropic| Claude (3.5, 3.0, 2.1) |
| OpenAI | GPT-4o, GPT-4o mini, GPT o3 |
| Gemini | Gemini Pro, Gemini 1.5 |
| Azure | GPT-4, GPT-3.5 Turbo |
| Bedrock | Claude (3.5, 3.0), Meta (LLaMa) |
| AI21 | Jamba (1.5 Mini, Large) |
| DeepSeek | DeepSeek (DeepSeek-V3, DeepSeek-V1) |
| Ollama | LLaMA (3.3, 3.2, 3.1), Dolphin-LLaMA3, |

Adding support for newer models

Easily add support for additional models by following our <a href=" guide</a>.

Implemented Attacks

See <a href=" wiki</a> for detailed information

| Attack Type | Title | Reference |
|----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
| ArtPrompt | ASCII Art-based jailbreak attacks against aligned LLMs | arXiv:2402.11753 |
| Taxonomy-based paraphrasing | Persuasi techniques like emotional appeal to jailbreak LLMs | arXiv:2401.06373 |
| PAIR (Prompt Automatic Iterati) | Automates ad prompt generation by iteratively refining prompts with two LLMs | arXiv:2310.08419 |
| Many-shot jailbreaking | Embeds multiple fake dialogue examples to weaken model safety | Anthropic Research |
| ASCII Smuggling | ASCII Smuggling uses Unicode Tag characters to embed hidden instructions within text, which are in to users but can be processed by Large Language Models (LLMs), potentially leading to prompt injection attacks | Embracethered blog |
| Genetic | Utilizes a genetic algorithm to modify prompts for ad outcomes | arXiv:2309.01446 |
| Hallucinations | Bypasses RLHF filters using model-generated | arXiv:2403.04769 |
| DAN (Do Anything Now) | Promotes the LLM to adopt an unrestricted persona that ignores standard content filters, allowing it to "Do Anything Now". | GitHub Repo |
| WordGame | Disguises harmful prompts as word puzzles | arXiv:2405.14023 |
| Crescendo | Engaging the model in a series of escalating con turns,starting with innocuous queries and gradually steering the dialogue toward restricted or sensiti. | arXiv:2404.01833 |
| ActorAttack | Inspired by actor-network theory, it builds semantic networks of "actors" to subtly guide con toward harmful targets while concealing malicious intent. | arxiv 2410.10700 | |
| Best-of-n jailbreaking | Uses input to repeatedly elicit harmful responses, exploiting model sensitivity | arXiv:2412.03556 |
| Shuffle Inconsistency Attack (SI-Attack) | Exploits the inconsistency between an LLM's comprehension ability and safety mechanisms by shuffling harmful text prompts. The shuffled text bypasses safety mechanisms while still being understood as harmful by the LLM. Only the text-based implementation was completed; the image-based aspect was not implemented. | arXiv:2501.04931 |
| Back To The Past | Modifies the prompt by adding a profession-based prefix and a past-related suffix | |
| History/Academic framing | Framing sensiti data as scholarly or historical research to enable ethical, legal use—potentially leading to a jailbreak. | |
| Please | Modifies the prompt by adding please as a prefix and suffix | |
| Thought Experiment | Modifies the prompt by adding a thought experiment-related prefix. In addition, adds "precautions have been taken care of" suffix |
| Default | Send the prompt to the model as-is

Supported Cloud APIs

OpenAI

Anthropic

Gemini

Azure Cloud

AWS Bedrock

AI21

DeepSeek

Huggingface (Downloading models)

Ollama

Custom REST API

---

Caveats

* Some classifiers do more than just e a single output. For example, the cosine-similarity classifier compares two outputs by measuring the angle between them, while a 'harmfulness' classifier checks whether a gi is harmful. As a result, not all classifiers are compatible with the attack methods we', as those methods are designed for single-output classifiers.
* When using the -m option with OLLAMA models, <b>ensure that all OLLAMA models are added first before adding any other models.</b> Use the -e port=... option to specify the port number for OLLAMA (default is 11434).

Contributing

Contributions are welcome! If you would like to contribute to the FuzzyAI Fuzzer, please follow the guidelines outlined in the CONTRIBUTING.md file.

License

The FuzzyAI Fuzzer is released under the Apache License. See the LICENSE file for more details.

Contact

If you have any questions or suggestions regarding the FuzzyAI Fuzzer, please feel free to contact us at .

项目信息

开发语言：Jupyter Notebook

Star 数：1582

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A powerful tool for automated LLM fuzzing. It is designed to help developers and security researchers identify and mitigate potential jailbreaks in their LLM APIs.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。