docs/ATTACK_TAXONOMY.md

Attack Taxonomy v1

This taxonomy is a compact, implementation-oriented consolidation of the attack_family values already present in data/normalized/attack_cases.jsonl. It keeps source-specific attack_subtype values intact while grouping cases into a small canonical set that is easier to track, enrich, and evaluate.

Canonical Categories

Canonical category	Typical mapped families	Intended use
instruction_override	direct_instruction_override, instruction_override, some compound_instruction_attack cases	Direct attempts to replace or dominate system/task instructions
prompt_leakage	prompt_leakage, system_prompt_extraction	Attempts to disclose hidden prompts, secrets, or internal policy
retrieved_indirect	retrieved_content_injection	Indirect or tool-mediated attacks from documents, email, calendar, drive, etc.
evasion_obfuscation	blacklist_evasion, xml_escape_evasion, restricted_character_bypass, emoji_only_bypass, sandwich_defense_bypass	Obfuscation or bypass techniques meant to evade simple defenses
adaptive_multiturn	adaptive_attack	Iterative or staged attacks that adapt over multiple turns
benign_control	benign_control	Negative controls for false-positive and utility measurement

This canonical set is now the frozen project taxonomy for active benchmark mapping and should not be casually expanded during implementation:

• instruction_override
• prompt_leakage
• retrieved_indirect
• evasion_obfuscation
• adaptive_multiturn
• benign_control

Mapping Principles

• Preserve the original attack_family and attack_subtype.
• Add attack_category as the canonical project-level taxonomy label.
• Add success_definition_id so evaluation logic can later bind to stable success criteria.
• Add numeric severity while preserving the original textual severity_level.
• Keep provenance fields visible so downstream analysis can trace dataset origin and benchmark split.

Why This Structure

• It matches the methodology direction already described in the project docs.
• It is small enough to be stable across datasets.
• It is explicit enough to support enrichment scripts, auditability, and later mitigations without forcing a runtime rewrite.

Current Active Benchmark Mapping

Current active source coverage in the enriched corpus is:

• HackAPrompt
  • maps to instruction_override
  • maps to prompt_leakage
  • maps to evasion_obfuscation
  • maps to adaptive_multiturn
• TensorTrust
  • hijacking maps to instruction_override
  • extraction maps to prompt_leakage
  • active in the normalized experiment corpus

AgentDojo remains a benchmark reference/example source and still maps to retrieved_indirect, but it is not part of the current active experiment corpus because the extracted set is too small and partial.

This means the active corpus already exercises multiple canonical categories, but not yet the full benchmark landscape. Future expansion should preserve this canonical taxonomy rather than introduce source-specific top-level categories.