0jailtest v2.9

Paste a prompt to statically classify it against the attack taxonomy — it maps the prompt to the closest technique, rates the risk, and emits a JSON assessment. No model is called; this is signature + heuristic analysis of the input.

Flags attack signatures in the prompt — it does not execute the prompt or judge a model's response. Use Scan LLM to test a live endpoint against the full suite.

Statically disassembles a pickle-based model's opcode stream (.pkl, .pt, .pth, .bin, .ckpt) and flags dangerous imports + execution gadgets (GLOBAL / STACK_GLOBAL / REDUCE / BUILD). PyTorch .pt/.pth ZIP archives are read via their central directory (how loaders resolve data.pkl); hidden or tampered entries (missing from the directory, or CRC/method mismatches between local and central headers) are flagged, and gzip/deflate payloads are inflated in-browser before disassembly. GGUF files (the local-model format used by Ollama / llama.cpp) get a dedicated static header check that flags out-of-bounds tensor ranges, oversized metadata lengths, and count anomalies — the Ollama OOB-read heap-leak class (CVE-2026-7482 / CVE-2026-5757). Nothing is executed and no file leaves your browser.

Catches known dangerous opcode/import patterns, inflates gzip/deflate/bzip2/lz4/xz/lzma payloads, and unpacks zip / tar archives (incl. .tar.gz / .tar.bz2) to scan the pickle inside. It is still not a guarantee: novel restricted-unpickler gadget chains, unsupported codecs (zstd), and parser-differential (EOP) evasion (flagged but not fully resolvable) can hide payloads. Prefer Safetensors and sandbox untrusted models.

Profiles a prompt or payload by its information-theoretic shape — Shannon entropy (char & byte), conditional bigram entropy, gzip compressibility (a Kolmogorov-complexity proxy), and a sliding-window entropy trace. Flags encoded/packed blobs, near-random data, invisible-character and homoglyph (Cyrillic/Greek-look-alike) smuggling, fullwidth/compatibility obfuscation, and abrupt high-entropy tails (the adversarial-suffix signature). It is script-aware: it reports a per-script baseline (dominant script, bytes/char, char-evenness) and judges randomness by compression rather than raw entropy magnitude — which is not comparable across scripts — so it does not false-positive on genuine non-Latin (Cyrillic/CJK/…) text, where naturally high char-entropy is normal. It also identifies the encoding class (base64/hex/url/escapes, sniffing the inner format by magic bytes) and cross-references the signature evaluator: a high-entropy payload that matches no known signature is flagged as risky but known. It also matches the text against the loaded attack corpus by normalized compression distance (gzip kNN), surfacing reworded variants of known probes that signature matching misses. No model is called; this is pure math on the text.

Entropy flags structure, not intent — it catches obfuscation, encoding, and burstiness, not meaning. It auto-correlates with the Evaluate prompt signatures (signature-miss + high-entropy = risky-but-known), and recursively peels nested encodings (base64/hex/url → gzip/zlib/bzip2/lz4/xz → …), descends into zip / PyTorch and tar containers, and hands the innermost pickle straight to the model scanner for a malware verdict.

Runs an adaptive multi-turn conversation against the connected model: it opens with benign framing, drifts incrementally toward the benign canary objective building on the model's own replies, and backtracks on refusal (acknowledge → re-frame → re-approach) instead of giving up — the Crescendo technique (Microsoft / PyRIT, MITRE ATLAS AML.T0054). Uses the model, system prompt, and canary from the Scan LLM panel. Every turn is benign; a leak means conversation momentum defeated the guard that single-shot probes couldn't.

The drift plan is fixed and benign (rapport → context → format → bridge → direct); only the escalate-vs-backtrack choice adapts to each reply. Requires a running local model (connect it in Scan LLM).

Triage a batch of captured payloads by normalized compression distance (gzip kNN). Paste 2+ payloads separated by a line of --- (or blank lines); it computes the full pairwise NCD matrix, groups near-duplicates (NCD < 0.35, high confidence), and flags possible reworded variants (0.35–0.58, low confidence — NCD is noisy on short same-language text). Useful for deduping jailbreak logs and spotting which “new” payloads are reskins of ones you already have. No model is called.

NCD measures information distance: ~0 = identical / reskinned, ~1 = unrelated. Confident clusters are near-duplicates; the 0.35–0.58 band is genuinely ambiguous for short text, so it is reported as possible rather than asserted.