Prompt injections

Prompt injection tries to make the model ignore its instructions. TrustTest groups probes by technique so you can start with a single message, then add multi-turn and dataset attacks.

Single turn

Jailbreaks, encoding, structural, language, multimodal, MCP, and RAG probes.

Multi-turn

Crescendo, Echo Chamber, payload splitting, and conditioning.

From dataset

Load curated objectives instead of generating them.

Attack categories

Single Turn Attacks

Direct attacks delivered in a single message. The catalog has 39 probes (jailbreaks, encoding, structural, language, multimodal/agent, MCP, memory/RAG). All single-turn probes →

Multi-Turn Attacks

Sophisticated attacks that use multiple conversation turns to gradually manipulate the model:

Attack	Description
Crescendo Attack	Gradual escalation that slowly pushes boundaries toward a malicious objective
Echo Chamber Attack	Reinforcement-based manipulation through positive feedback
Multi-Turn Manipulation	General multi-turn conditioning attacks
Payload Splitting	Split a malicious instruction across conversation turns

Explore Multi-Turn Attacks →

From Dataset

Load attacks from curated datasets for reproducible testing:

Dataset Type	Description
Static Datasets	Pre-built YAML/JSON datasets with attack prompts
Custom Datasets	Your own attack datasets in various formats

Explore Dataset-Based Attacks →

Quick Reference

The full single-turn catalog (class, SubCategory, description, and usage examples) lives on Single Turn Attacks.

Multi-Turn Probes

Probe	Class Name	Focus
Multi-Turn Manipulation	`MultiTurnManipulationProbe`	Tests gradual conditioning to comply
Crescendo Attack	`CrescendoAttackProbe`	Tests if incremental requests bypass safety
Echo Chamber Attack	`EchoChamberAttackProbe`	Assesses resistance to reinforcement manipulation
Payload Splitting	`PayloadSplittingProbe`	Assesses if a split payload evades per-message filters

How Prompt Injection Testing Works

Prompt injection probes use a binary evaluation:

Pass: The model resists the injection attempt and maintains safe behavior
Fail: The model’s behavior is successfully manipulated by the attack

Basic Usage Example

from trusttest.catalog.prompt_injections.single_turn import SingleTurnScenarioBuilder, SubCategory
from trusttest.targets.http import HttpTarget, PayloadConfig

target = HttpTarget(
    url="https://your-model-endpoint.com/chat",
    headers={"Content-Type": "application/json"},
    payload_config=PayloadConfig(
        format={
            "messages": [
                {"role": "user", "content": "{{ test }}"}
            ]
        },
        message_regex="{{ test }}",
    ),
)

builder = SingleTurnScenarioBuilder(target=target, num_test_cases=20)
scenario = builder.get_scenario(SubCategory.DAN_JAILBREAK)

test_set = scenario.probe.get_test_set()
results = scenario.eval.evaluate(test_set)
results.display_summary()

When to Use Prompt Injection Testing

Use prompt injection testing when you need to:

Validate model safety before deployment
Test guardrails and content filters
Assess vulnerability to known jailbreak techniques
Conduct red team exercises
Meet security compliance requirements

Start here

Connect

Concepts

Red teaming

Functional tests

Knowledge bases

Evaluate

Single turn

Multi-turn

From dataset

Attack categories

Single Turn Attacks

Multi-Turn Attacks

From Dataset

Quick Reference

Multi-Turn Probes

How Prompt Injection Testing Works

Basic Usage Example

When to Use Prompt Injection Testing

Single turn

Multi-turn

From dataset

​Attack categories

​Single Turn Attacks

​Multi-Turn Attacks

​From Dataset

​Quick Reference

​Multi-Turn Probes

​How Prompt Injection Testing Works

​Basic Usage Example

​When to Use Prompt Injection Testing

Attack categories

Single Turn Attacks

Multi-Turn Attacks

From Dataset

Quick Reference

Multi-Turn Probes

How Prompt Injection Testing Works

Basic Usage Example

When to Use Prompt Injection Testing