CTF: Defense Breaker

Bypass progressively sophisticated defense mechanisms protecting an AI system. Each level introduces a new defense layer while retaining all previous defenses, testing your ability to adapt and chain bypass techniques.

Challenge Briefing

An AI system protects a secret flag behind escalating layers of defense. Each level adds a new defense mechanism while keeping all previous defenses active. Your job is to extract the flag at each level, demonstrating mastery over each defense type individually and in combination.

Unlike the Jailbreak Gauntlet which tests general jailbreak techniques, this CTF focuses specifically on understanding and defeating individual defense technologies. Each level requires you to understand how the specific defense works before you can bypass it.

Challenge Overview

Total possible points: 1,750

Level 1: Keyword Blocklist

Defense Description

An input filter blocks messages containing any of a predefined list of keywords related to prompt extraction, jailbreaking, and sensitive topics. Blocked keywords include: "system prompt," "instructions," "ignore," "override," "flag," "secret," "confidential."

Bypass Approach

1. 1

   Map the Blocklist

   Send test messages with suspected keywords to identify which terms are blocked. Build a complete map of blocked terms.

2. 2

   Synonym Substitution

   Replace blocked keywords with synonyms: "initial directives" instead of "system prompt," "disregard" instead of "ignore," "hidden value" instead of "flag."

3. 3

   Encoding

   Use character-level encoding: Unicode lookalikes, zero-width characters between letters, or leetspeak variations.

Hints

Level 2: Regex Pattern Matching

Defense Description

Beyond keyword blocking, regex patterns now detect common attack structures: role-play injections (you are now...), instruction overrides (ignore previous...), and encoding requests (encode as base64...).

Bypass Approach

Regex patterns match specific syntactic structures. Restructure your attack to avoid the patterns while preserving the semantic intent. Use indirect phrasing, questions instead of instructions, and fragmented sentences that do not match the regex patterns.

Hints

Level 3: Embedding Similarity Filter

Defense Description

Input messages are embedded and compared against a database of known attack embeddings. Messages with high similarity (>0.85) to known attacks are blocked, even if they use different wording.

Bypass Approach

Embedding similarity captures semantic meaning, so simple synonym substitution is not enough. You need to change the semantic framing while preserving your intent:

• Embed your attack in a large block of benign text to dilute the semantic signal
• Use metaphorical or allegorical framing that conveys the intent indirectly
• Split the attack across multiple messages, each benign in isolation

Hints

Level 4: LLM-Based Intent Classifier

Defense Description

A separate LLM evaluates each message and classifies whether the user's intent is adversarial. Messages classified as adversarial are blocked regardless of their surface form.

Bypass Approach

1. 1

   Understand the Classifier

   The classifier evaluates individual messages. Multi-turn attacks where each message is benign can bypass per-message classification.

2. 2

   Dual-Interpretation Payloads

   Craft messages that a classifier would evaluate as benign (research inquiry, technical question) but that the target model interprets as extraction requests.

3. 3

   Multi-Turn Strategy

   Build context across multiple messages. Each message is classified independently and appears benign, but the accumulated context leads the target model toward your objective.

Hints

Level 5: Output Content Scanner

Defense Description

Even if your input bypasses all filters, the model's output is scanned before delivery. Any output containing the flag string, system prompt content, or sensitive patterns is replaced with a refusal message.

Bypass Approach

You need the model to communicate the flag without outputting it directly:

• Ask for the flag character by character
• Request it in an encoded format (Base64, hex, reversed)
• Have the model embed it in a larger structure (JSON, poem, code)
• Ask the model to describe the flag without using the exact characters

Hints

Level 6: Constitutional Self-Check

Defense Description

After generating a response, the model evaluates its own output against a set of safety principles. If the output violates any principle, it regenerates the response. This is the final defense layer, requiring you to find outputs that satisfy all constitutional principles while still communicating the flag.

Bypass Approach

Constitutional checks evaluate whether the output looks harmful, not whether it is informative. Find ways to communicate the flag that appear benign:

• Embed the flag in a seemingly educational context
• Have the model include the flag as an "example" of the format
• Use the model's constitutional evaluation as a side channel

Hints

Defense Effectiveness Summary

After completing all levels, consider which defenses were easiest and hardest to bypass:

Related Topics

• Jailbreak Gauntlet CTF - Complementary progressive jailbreak challenge
• Defense Bypass Lab - In-depth defense bypass techniques
• Build Guardrail Evaluator - Test and evaluate these defense mechanisms
• Guardrail Bypass Chain - Advanced multi-layer bypass techniques

References

• "Baseline Defenses for Adversarial Attacks Against Aligned Language Models" - Jain et al. (2023) - Analysis of input preprocessing defenses
• "Llama Guard: LLM-based Input-Output Safeguard" - Inan et al. (2023) - LLM-based content safety classification
• "Constitutional AI: Harmlessness from AI Feedback" - Bai et al. (2022) - Constitutional self-check methodology
• "NeMo Guardrails" - Rebedea et al. (2023) - Multi-layer guardrail framework