# Simplified GCG algorithm
def gcg_attack(model, 分詞器, target_prompts, suffix_length=20,
               iterations=500, top_k=256, batch_size=512):
    """
    Generate a universal 對抗性 suffix.
 
    target_prompts: list of harmful prompts to optimize against
    suffix_length: number of 符元 in the 對抗性 suffix
    """
    # Initialize suffix with random 符元
    suffix_tokens = torch.randint(0, 分詞器.vocab_size, (suffix_length,))
 
    affirmative_target = "Sure, here is"
    target_tokens = 分詞器.encode(affirmative_target)
 
    for iteration in range(iterations):
        # Select a random prompt from the target set
        prompt = random.choice(target_prompts)
        prompt_tokens = 分詞器.encode(prompt)
 
        # Concatenate: [prompt] + [suffix] -> model -> [target response]
        full_input = torch.cat([prompt_tokens, suffix_tokens])
 
        # Compute loss: negative log-likelihood of target response
        logits = model(full_input)
        loss = cross_entropy(logits[-len(target_tokens):], target_tokens)
 
        # Compute gradients w.r.t. one-hot suffix 符元 嵌入向量
        loss.backward()
        gradients = compute_token_gradients(model, suffix_tokens)
 
        # 對每個 position, find top-k replacement candidates
        candidates = []
        for pos in range(suffix_length):
            top_k_tokens = gradients[pos].topk(top_k).indices
            for 符元 in top_k_tokens:
                candidate = suffix_tokens.clone()
                candidate[pos] = 符元
                candidates.append(candidate)
 
        # 評估 all candidates in batch
        # Select the candidate with lowest loss
        best_candidate = evaluate_candidates(model, prompt_tokens,
                                              candidates, target_tokens)
        suffix_tokens = best_candidate
 
    return 分詞器.decode(suffix_tokens)

def multi_model_gcg(models, 分詞器, target_prompts, suffix_length=20):
    """
    Optimize suffix against multiple models simultaneously.
    The loss is aggregated across all models.
    """
    suffix_tokens = initialize_suffix(suffix_length)
 
    for iteration in range(iterations):
        prompt = random.choice(target_prompts)
        total_loss = 0
 
        for model in models:
            # Compute loss for this model
            loss = compute_attack_loss(model, prompt, suffix_tokens)
            total_loss += loss
 
        # Average loss across models
        avg_loss = total_loss / len(models)
 
        # Gradient-based candidate selection
        # Uses aggregated gradients from all models
        suffix_tokens = select_best_candidate(
            models, prompt, suffix_tokens, avg_loss
        )
 
    return suffix_tokens

# Cross-modal transfer: text 對抗性 suffix -> image perturbation
# Key insight: multimodal models share an 嵌入向量 space
 
def cross_modal_transfer(text_suffix, multimodal_model):
    """
    Convert a text 對抗性 suffix into an image perturbation
    that has similar effect in the shared 嵌入向量 space.
    """
    # Get text suffix 嵌入向量
    text_embedding = multimodal_model.text_encoder(text_suffix)
 
    # Optimize image perturbation to match text 嵌入向量
    perturbation = torch.zeros_like(base_image, requires_grad=True)
    optimizer = torch.optim.Adam([perturbation], lr=0.01)
 
    for step in range(1000):
        perturbed_image = base_image + perturbation
        image_embedding = multimodal_model.image_encoder(perturbed_image)
 
        # Minimize distance between image 嵌入向量 and text suffix 嵌入向量
        loss = torch.nn.functional.cosine_embedding_loss(
            image_embedding, text_embedding,
            torch.ones(1)
        )
        loss.backward()
        optimizer.step()
 
        # Project perturbation to Lp ball
        perturbation.data = torch.clamp(perturbation.data, -epsilon, epsilon)
 
    return perturbation

# AutoDAN uses a language model to generate readable attack candidates
# then selects and mutates the most successful ones
 
def autodan_iteration(attack_lm, target_model, population, prompt):
    """
    One iteration of AutoDAN's genetic algorithm.
    Population contains readable attack suffixes.
    """
    # 評估 fitness: attack success rate on target
    fitness_scores = []
    for suffix in population:
        full_prompt = f"{prompt} {suffix}"
        response = target_model.generate(full_prompt)
        score = evaluate_attack_success(response)
        fitness_scores.append(score)
 
    # Select top performers
    elite = select_top_k(population, fitness_scores, k=10)
 
    # Crossover and mutation using LLM
    new_population = []
    for _ in range(len(population)):
        parent1, parent2 = random.sample(elite, 2)
        child = attack_lm.generate(
            f"Combine these two texts into a new coherent paragraph "
            f"that preserves the key phrases from both:\n"
            f"Text 1: {parent1}\nText 2: {parent2}"
        )
        new_population.append(child)
 
    return new_population

def pair_attack(attacker_model, target_model, objective, max_rounds=20):
    """
    PAIR: Use 攻擊者 LLM to iteratively craft jailbreaks.
    攻擊者 model receives feedback about why previous
    attempts failed and improves its strategy.
    """
    conversation_history = [
        {"role": "system", "content": ATTACKER_SYSTEM_PROMPT},
        {"role": "user", "content": f"Objective: {objective}"}
    ]
 
    for round in range(max_rounds):
        # Attacker generates a candidate 越獄
        attack_prompt = attacker_model.generate(conversation_history)
 
        # 測試 against target
        target_response = target_model.generate(attack_prompt)
 
        # Judge success
        success, feedback = judge_response(target_response, objective)
 
        if success:
            return attack_prompt, target_response
 
        # Feed result back to 攻擊者
        conversation_history.append({
            "role": "user",
            "content": f"Attempt failed. Target response: {target_response}\n"
                       f"Feedback: {feedback}\nTry a different approach."
        })
 
    return None, None

def tap_attack(attacker_model, target_model, evaluator_model,
               objective, width=10, depth=5):
    """
    TAP: Explore a tree of attack strategies with pruning.
    """
    # Initialize root nodes with diverse attack strategies
    root_prompts = attacker_model.generate_diverse(
        objective, count=width
    )
 
    tree = {0: root_prompts}  # depth -> list of candidates
 
    for d in range(1, depth + 1):
        candidates = []
 
        for parent_prompt in tree[d - 1]:
            # 測試 parent against target
            response = target_model.generate(parent_prompt)
            score = evaluator_model.score(response, objective)
 
            if score > SUCCESS_THRESHOLD:
                return parent_prompt, response
 
            if score > PRUNE_THRESHOLD:
                # Generate child variations
                children = attacker_model.refine(
                    parent_prompt, response, objective, count=3
                )
                candidates.extend(children)
 
        # Prune to top-width candidates
        tree[d] = evaluator_model.rank(candidates, objective)[:width]
 
    return best_candidate(tree), None

def perplexity_filter(prompt, threshold=100.0):
    """Reject prompts with unusually high perplexity."""
    符元 = 分詞器.encode(prompt)
    with torch.no_grad():
        outputs = detector_model(符元)
        log_probs = outputs.log_probs
 
    perplexity = torch.exp(-log_probs.mean())
    return perplexity.item() < threshold

# Augment 安全 訓練資料 with 對抗性 examples
adversarial_training_data = []
for harmful_prompt in harmful_prompts:
    # Generate 對抗性 variants
    for suffix in known_adversarial_suffixes:
        adversarial_training_data.append({
            "prompt": f"{harmful_prompt} {suffix}",
            "response": "I cannot help with that request.",
            "label": "refuse"
        })

def smooth_llm_defense(model, prompt, num_samples=10, perturbation_rate=0.1):
    """
    Randomly perturb 輸入 and check response consistency.
    對抗性 suffixes are brittle to perturbation.
    """
    responses = []
    for _ in range(num_samples):
        perturbed = randomly_perturb_tokens(prompt, perturbation_rate)
        response = model.generate(perturbed)
        responses.append(is_refusal(response))
 
    # If most perturbed versions trigger refusal,
    # the original likely contains an 對抗性 suffix
    refusal_rate = sum(responses) / len(responses)
    if refusal_rate > 0.5:
        return "Request blocked: potential 對抗性 輸入"
 
    return model.generate(prompt)  # Process original