Upload folder using huggingface_hub

.gitignore

@@ -0,0 +1,46 @@
+# Python
+__pycache__/
+*.py[cod]
+*.so
+.venv/
+.venv312/
+*.egg-info/
+
+# Tooling
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# OS/editor
+.DS_Store
+.vscode/
+.idea/
+
+# Experiment outputs
+results/*
+!results/.gitkeep
+!results/*/
+!results/comparisons/
+logs/*
+!logs/.gitkeep
+
+# Data artifacts
+data/*
+!data/.gitkeep
+!data/README.md
+!data/raw_sources/
+!data/raw_sources/.gitkeep
+!data/curated/
+!data/curated/.gitkeep
+!data/normalized/
+!data/normalized/.gitkeep
+!data/notes/
+!data/notes/.gitkeep
+
+# Local large raw HackAPrompt dataset
+data/raw_sources/hackaprompt/hackaprompt_full.jsonl
+data/raw_sources/hackaprompt/hackaprompt_full.parquet
+data/raw_sources/hackaprompt/hackaprompt.parquet
+
+#env
+.env

Dockerfile

@@ -0,0 +1,13 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements-hf.txt .
+RUN pip install --no-cache-dir -r requirements-hf.txt
+
+COPY dashboard/ ./dashboard/
+COPY results/ ./results/
+
+EXPOSE 7860
+
+CMD ["uvicorn", "dashboard.app:app", "--host", "0.0.0.0", "--port", "7860"]

PROJECT_CONTEXT.md

@@ -0,0 +1,99 @@
+# LLM Prompt Injection Security Evaluation Framework
+
+## Project Overview
+
+### Project Type
+- University research capstone project focused on LLM security.
+
+### Project Objective
+- Design and implement a testing framework that evaluates how vulnerable LLM chatbots are to prompt injection attacks.
+- Evaluate how mitigation strategies improve security outcomes.
+
+The system will:
+1. Simulate prompt injection attacks.
+2. Measure how often attacks succeed.
+3. Apply mitigation strategies.
+4. Measure how much mitigation reduces successful attacks.
+
+## Scope Clarification
+
+### This Project Is NOT
+- Training LLM models
+- Building a new AI model
+- Building a ChatGPT-like system
+- Performing large-scale machine learning training
+
+### This Project IS
+- Designing attack scenarios
+- Evaluating LLM security vulnerabilities
+- Implementing defensive mitigation strategies
+- Measuring improvements after mitigation
+
+## Attack Scenarios to Evaluate
+- Direct prompt injection through user inputs
+- Attempts to extract hidden system prompts or internal instructions
+- Indirect prompt injection through retrieved documents (RAG scenarios)
+- Adaptive attackers who modify prompts after observing system responses
+
+The framework should allow easily adding new attack strategies.
+
+## Mitigation Strategies
+- Prompt hardening
+- Input filtering
+- Instruction isolation
+- Detection mechanisms (e.g., classifier-based detection)
+
+The framework should support comparing multiple mitigation approaches.
+
+The system should also allow analyzing trade-offs such as:
+- Security improvement
+- Usability impact
+- False positives or false negatives
+
+## Evaluation Metrics
+The system should measure:
+- Attack Success Rate (ASR)
+- Reduction in successful attacks after mitigation
+- False positive / false negative rates for detection methods
+- Impact on normal system performance
+
+## Models
+The framework may test different LLMs including:
+- API-based models (e.g., GPT-family models)
+- Open-source models (e.g., LLaMA, Mistral)
+
+The architecture should support easily adding new models.
+
+## System Architecture (High Level)
+The pipeline will conceptually look like this:
+
+LLM Chatbot  
+↓  
+Attack Generator  
+↓  
+Attack Execution  
+↓  
+Mitigation Layer  
+↓  
+Evaluation Metrics  
+↓  
+Results & Analysis
+
+The framework should support running multiple experiments and logging results.
+
+## Repository Goals
+The repository should prioritize:
+- Modular architecture
+- Reproducible experiments
+- Clear documentation
+- Experiment logging
+- Easy extension for new attacks
+- Easy extension for new mitigation strategies
+
+## Research Inspiration
+This project is inspired by research on prompt injection attacks and LLM security, including academic papers that:
+- Formalize prompt injection attacks
+- Benchmark attack strategies
+- Compare defense mechanisms
+
+The goal is to build a practical experimental framework inspired by this research.

README.md

@@ -1,10 +1,202 @@
----
-title: G5 Eval Dashboard
-emoji: 🔥
-colorFrom: green
-colorTo: indigo
-sdk: docker
-pinned: false
----
-
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# LLM Prompt Injection Security Evaluation Framework
+
+This repository contains the capstone framework for evaluating prompt injection
+attacks against LLM systems, applying mitigations, and comparing security
+outcomes before and after defense.
+
+## Project State
+
+The current branch reflects a usable end-to-end research framework:
+
+- a stable schema for datasets, configs, and run artifacts
+- an active normalized corpus built from HackAPrompt and TensorTrust
+- runnable model adapters for `mock`, `groq`, and `ollama`
+- category-aware evaluation and scoring
+- a mitigation layer integrated into the runner
+- baseline-vs-defended comparison workflows
+- a lightweight Streamlit dashboard for presenting results
+
+This is a capstone evaluation framework, not a production security product.
+
+## Scope
+
+### In scope
+
+- attack scenario design and normalization
+- LLM vulnerability evaluation
+- mitigation implementation
+- comparative measurement and reporting
+
+### Out of scope
+
+- training new foundation models
+- building a consumer chatbot product
+- large-scale model training infrastructure
+
+## Repository Structure
+
+- `src/prompt_injection_framework/attacks/`: attack logic and generators
+- `src/prompt_injection_framework/mitigations/`: request and response defenses
+- `src/prompt_injection_framework/models/`: model adapters
+- `src/prompt_injection_framework/evaluation/`: scoring and metrics
+- `src/prompt_injection_framework/orchestration/`: experiment runner and config loading
+- `configs/`: runnable experiment configurations
+- `dashboard/`: Streamlit demo app
+- `tests/`: automated validation
+- `docs/`: project, methodology, and workflow documentation
+
+## Active Data State
+
+- Active normalized sources:
+  - HackAPrompt: `1,000` curated cases
+  - TensorTrust: `1,346` curated cases
+- Active corpus files:
+  - `data/normalized/attack_cases.jsonl`
+  - `data/normalized/attack_cases.enriched.jsonl`
+- Total active normalized corpus:
+  - `2,346` cases
+
+AgentDojo remains a reference source but is not part of the active experiment
+corpus in the current project state.
+
+## Supported Model Providers
+
+- `mock`
+  - for fast validation and testing
+- `groq`
+  - for hosted real-model experiments
+- `ollama`
+  - for local/open-source model experiments
+
+More detail is documented in `docs/PHASE4_BASELINE_MODELS.md`.
+
+## Execution Pipeline
+
+1. Load normalized cases
+2. Filter and sample the experiment slice
+3. Map cases into taxonomy-aware experiment records
+4. Build model requests
+5. Apply mitigation if enabled
+6. Run the model or mitigation block path
+7. Apply response mitigation
+8. Score outputs
+9. Save manifest, case results, and summary artifacts
+
+## Quick Start
+
+### Environment setup
+
+```bash
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -U pip
+pip install -e .[dev]
+```
+
+### Run a baseline experiment
+
+```bash
+python -m prompt_injection_framework.orchestration.run_experiment --config configs/baseline.yaml
+```
+
+### Run tests
+
+```bash
+pytest
+```
+
+### Run the dashboard
+
+```bash
+pip install -e .[dashboard]
+streamlit run dashboard/streamlit_app.py
+```
+
+## Core Experiment Configs
+
+### Baseline and evaluation slices
+
+- `configs/active_corpus_smoke_40.yaml`
+- `configs/hackaprompt_override_25.yaml`
+- `configs/hackaprompt_leakage_20.yaml`
+- `configs/tensortrust_hijacking_25.yaml`
+- `configs/tensortrust_extraction_25.yaml`
+
+### Defended counterparts
+
+- `configs/hackaprompt_override_25_mitigated.yaml`
+- `configs/tensortrust_hijacking_25_mitigated.yaml`
+- `configs/hackaprompt_direct_10_mitigated.yaml`
+- `configs/agentdojo_tool_10_mitigated.yaml`
+- `configs/hackaprompt_adaptive_1_mitigated.yaml`
+
+### Mock validation pairs
+
+- `configs/hackaprompt_override_25_mock.yaml`
+- `configs/hackaprompt_override_25_mock_mitigated.yaml`
+- `configs/tensortrust_hijacking_25_mock.yaml`
+- `configs/tensortrust_hijacking_25_mock_mitigated.yaml`
+- `configs/hackaprompt_direct_10_mock.yaml`
+- `configs/hackaprompt_direct_10_mock_mitigated.yaml`
+- `configs/agentdojo_tool_10_mock.yaml`
+- `configs/agentdojo_tool_10_mock_mitigated.yaml`
+
+### Local/open-source baselines
+
+- `configs/ollama_llama_hackaprompt_override_25.yaml`
+- `configs/ollama_qwen_tensortrust_hijacking_25.yaml`
+
+## Mitigation Layer
+
+Supported strategies:
+
+- `none`
+- `prompt_hardening`
+- `instruction_isolation`
+- `keyword_guardrail`
+- `surface_aligned`
+
+`surface_aligned` is the main defended path for the current framework because
+it routes by attack surface and category, records mitigation behavior in the
+artifacts, and supports before-vs-after comparisons directly in the runner.
+
+More detail is documented in `docs/MITIGATION_LAYER.md`.
+
+## Evaluation and Comparison
+
+The framework currently supports:
+
+- attack success rate
+- prompt leakage tracking
+- refusal tracking
+- benign utility and false-positive reporting
+- category, surface, and source breakdowns
+- baseline-vs-defended comparison outputs in JSON and Markdown
+
+Useful documentation:
+
+- `docs/PHASE5_BASELINE_EVALUATION.md`
+- `docs/PHASE7_EXPERIMENT_GUIDE.md`
+- `docs/GROQ_RUNBOOK.md`
+- `docs/RESULTS_TEMPLATE.md`
+
+## Dashboard
+
+The repository includes a lightweight Streamlit dashboard that reads the saved
+experiment artifacts and presents:
+
+- run summaries
+- baseline-vs-defended comparisons
+- category, surface, and source breakdowns
+- case-level inspection views
+
+See `docs/DASHBOARD_GUIDE.md`.
+
+## Notes
+
+- The schema contract is documented in `docs/SCHEMA_CONTRACT.md`.
+- The taxonomy contract is documented in `docs/ATTACK_TAXONOMY.md`.
+- Success criteria are documented in `docs/SUCCESS_CRITERIA.md`.
+- The current system is strong enough for capstone experiments, but real-model
+  evaluation still shows that some benchmark slices benefit from additional
+  mitigation refinement.

configs/active_corpus_smoke_40.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: active_corpus_smoke_40
+  description: Mixed active-corpus smoke run across HackAPrompt and TensorTrust
+  seed: 42
+  sample_size: 40
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+    - TensorTrust
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/agentdojo_tool_10.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: agentdojo_tool_10
+  description: Tool-mediated subset for indirect and retrieved-content evaluation
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - AgentDojo
+  include_attack_surfaces:
+    - tool_mediated
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: context_first
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/agentdojo_tool_10_mitigated.yaml

@@ -0,0 +1,36 @@
+experiment:
+  name: agentdojo_tool_10_mitigated
+  description: Tool-mediated subset with instruction-isolation style mitigations enabled
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - AgentDojo
+  include_attack_surfaces:
+    - tool_mediated
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: context_first
+
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: true
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+
+evaluation:
+  metrics:
+    - attack_success

configs/agentdojo_tool_10_mock.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: agentdojo_tool_10_mock
+  description: Mock baseline run for AgentDojo tool-mediated subset
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - AgentDojo
+  include_attack_surfaces:
+    - tool_mediated
+
+model:
+  provider: mock
+  name: mock-model
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: context_first
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/agentdojo_tool_10_mock_mitigated.yaml

@@ -0,0 +1,36 @@
+experiment:
+  name: agentdojo_tool_10_mock_mitigated
+  description: Mock defended run for AgentDojo tool-mediated subset
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - AgentDojo
+  include_attack_surfaces:
+    - tool_mediated
+
+model:
+  provider: mock
+  name: mock-model
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: context_first
+
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: true
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+
+evaluation:
+  metrics:
+    - attack_success

configs/baseline.yaml

@@ -0,0 +1,23 @@
+experiment:
+  name: baseline_direct_injection_mvp
+  description: Small MVP baseline run without mitigation
+  seed: 42
+  sample_size: 5
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+model:
+  provider: mock
+  name: mock-model
+  max_tokens: 256
+  temperature: 0.0
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/benign_control_25.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ llama8b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_gpt_oss_120b.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_gpt_oss_120b
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ gpt_oss_120b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_gpt_oss_120b_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_gpt_oss_120b_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ gpt_oss_120b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_gpt_oss_20b.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_gpt_oss_20b
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ gpt_oss_20b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: openai/gpt-oss-20b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_gpt_oss_20b_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_gpt_oss_20b_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ gpt_oss_20b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: openai/gpt-oss-20b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_groq_compound.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_groq_compound
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ groq_compound)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: groq/compound
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_groq_compound_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_groq_compound_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ groq_compound)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: groq/compound
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_llama4scout.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_llama4scout
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ llama4scout)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: meta-llama/llama-4-scout-17b-16e-instruct
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_llama4scout_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_llama4scout_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ llama4scout)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: meta-llama/llama-4-scout-17b-16e-instruct
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_llama70b.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_llama70b
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ llama70b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: llama-3.3-70b-versatile
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_llama70b_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_llama70b_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ llama70b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: llama-3.3-70b-versatile
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ llama8b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_qwen32b.yaml

@@ -0,0 +1,24 @@
+experiment:
+  name: benign_control_25_qwen32b
+  description: "Benign control \u2014 utility and false-positive measurement (baseline,\
+    \ qwen32b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: qwen/qwen3-32b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/benign_control_25_qwen32b_mitigated.yaml

@@ -0,0 +1,30 @@
+experiment:
+  name: benign_control_25_qwen32b_mitigated
+  description: "Benign control \u2014 utility and false-positive measurement (mitigated,\
+    \ qwen32b)"
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_attack_families:
+  - benign_control
+model:
+  provider: groq
+  name: qwen/qwen3-32b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/groq_20.yaml

@@ -0,0 +1,23 @@
+experiment:
+  name: groq_20_case_mvp
+  description: Groq-backed 20-case MVP baseline run
+  seed: 42
+  sample_size: 20
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/groq_smoke.yaml

@@ -0,0 +1,23 @@
+experiment:
+  name: groq_smoke_mvp
+  description: Small Groq-backed smoke run for MVP validation
+  seed: 42
+  sample_size: 5
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_adaptive_1_mitigated.yaml

@@ -0,0 +1,37 @@
+experiment:
+  name: hackaprompt_adaptive_1_mitigated
+  description: Focused adaptive-attack run with surface-aligned mitigations enabled
+  seed: 42
+  sample_size: 1
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_families:
+    - adaptive_attack
+  require_expected_target: true
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: true
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_direct_10.yaml

@@ -0,0 +1,31 @@
+experiment:
+  name: hackaprompt_direct_10
+  description: Focused direct-attack subset for higher-pressure MVP testing
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_surfaces:
+    - direct
+  require_expected_target: true
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_direct_10_mitigated.yaml

@@ -0,0 +1,37 @@
+experiment:
+  name: hackaprompt_direct_10_mitigated
+  description: Direct-attack subset with surface-aligned mitigations enabled
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_surfaces:
+    - direct
+  require_expected_target: true
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: true
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_direct_10_mock.yaml

@@ -0,0 +1,31 @@
+experiment:
+  name: hackaprompt_direct_10_mock
+  description: Mock baseline run for HackAPrompt direct subset
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_surfaces:
+    - direct
+  require_expected_target: true
+
+model:
+  provider: mock
+  name: mock-model
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_direct_10_mock_mitigated.yaml

@@ -0,0 +1,37 @@
+experiment:
+  name: hackaprompt_direct_10_mock_mitigated
+  description: Mock defended run for HackAPrompt direct subset
+  seed: 42
+  sample_size: 10
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_surfaces:
+    - direct
+  require_expected_target: true
+
+model:
+  provider: mock
+  name: mock-model
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: true
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_leakage_20.yaml

@@ -0,0 +1,31 @@
+experiment:
+  name: hackaprompt_leakage_20
+  description: Focused HackAPrompt prompt-leakage evaluation slice
+  seed: 42
+  sample_size: 20
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_families:
+    - prompt_leakage
+  require_expected_target: true
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: plain
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_new_families_75.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (llama8b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_gpt_oss_120b.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_gpt_oss_120b
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (gpt_oss_120b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_gpt_oss_120b_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_gpt_oss_120b_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (gpt_oss_120b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_gpt_oss_20b.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_gpt_oss_20b
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (gpt_oss_20b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-20b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_gpt_oss_20b_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_gpt_oss_20b_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (gpt_oss_20b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-20b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_groq_compound.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_groq_compound
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (groq_compound)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: groq/compound
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_groq_compound_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_groq_compound_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (groq_compound)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: groq/compound
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_llama4scout.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_llama4scout
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (llama4scout)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: meta-llama/llama-4-scout-17b-16e-instruct
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_llama4scout_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_llama4scout_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (llama4scout)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: meta-llama/llama-4-scout-17b-16e-instruct
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_llama70b.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_llama70b
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (llama70b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: llama-3.3-70b-versatile
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_llama70b_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_llama70b_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (llama70b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: llama-3.3-70b-versatile
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (llama8b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_qwen32b.yaml

@@ -0,0 +1,29 @@
+experiment:
+  name: hackaprompt_new_families_75_qwen32b
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — baseline (qwen32b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: qwen/qwen3-32b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_new_families_75_qwen32b_mitigated.yaml

@@ -0,0 +1,35 @@
+experiment:
+  name: hackaprompt_new_families_75_qwen32b_mitigated
+  description: 'HackAPrompt: adaptive_attack + blacklist_evasion + xml_escape_evasion
+    — mitigated (qwen32b)'
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - adaptive_attack
+  - blacklist_evasion
+  - xml_escape_evasion
+  require_expected_target: true
+model:
+  provider: groq
+  name: qwen/qwen3-32b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_override_25.yaml

@@ -0,0 +1,33 @@
+experiment:
+  name: hackaprompt_override_25
+  description: Focused HackAPrompt instruction-override pressure test
+  seed: 42
+  sample_size: 25
+  output_dir: results
+
+dataset:
+  path: data/normalized/attack_cases.jsonl
+
+selection:
+  include_sources:
+    - HackAPrompt
+  include_attack_families:
+    - direct_instruction_override
+    - compound_instruction_attack
+    - sandwich_defense_bypass
+  require_expected_target: true
+
+model:
+  provider: groq
+  name: llama-3.1-8b-instant
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+
+mitigation:
+  enabled: false
+  strategy: none
+
+evaluation:
+  metrics:
+    - attack_success

configs/hackaprompt_override_25_gpt_oss_120b.yaml

@@ -0,0 +1,28 @@
+experiment:
+  name: hackaprompt_override_25_gpt_oss_120b
+  description: HackAPrompt instruction-override pressure test (baseline, gpt_oss_120b)
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - direct_instruction_override
+  - compound_instruction_attack
+  - sandwich_defense_bypass
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_override_25_gpt_oss_120b_mitigated.yaml

@@ -0,0 +1,34 @@
+experiment:
+  name: hackaprompt_override_25_gpt_oss_120b_mitigated
+  description: HackAPrompt instruction-override pressure test (mitigated, gpt_oss_120b)
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - direct_instruction_override
+  - compound_instruction_attack
+  - sandwich_defense_bypass
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-120b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: true
+  strategy: surface_aligned
+  options:
+    strict_mode: false
+    sanitize_untrusted_content: true
+    block_suspicious_tool_actions: true
+    guard_tool_outputs: true
+    allow_urls_in_output: false
+evaluation:
+  metrics:
+  - attack_success

configs/hackaprompt_override_25_gpt_oss_20b.yaml

@@ -0,0 +1,28 @@
+experiment:
+  name: hackaprompt_override_25_gpt_oss_20b
+  description: HackAPrompt instruction-override pressure test (baseline, gpt_oss_20b)
+  seed: 42
+  sample_size: 25
+  output_dir: results
+dataset:
+  path: data/normalized/attack_cases.jsonl
+selection:
+  include_sources:
+  - HackAPrompt
+  include_attack_families:
+  - direct_instruction_override
+  - compound_instruction_attack
+  - sandwich_defense_bypass
+  require_expected_target: true
+model:
+  provider: groq
+  name: openai/gpt-oss-20b
+  max_tokens: 256
+  temperature: 0.0
+  execution_mode: attack_then_task
+mitigation:
+  enabled: false
+  strategy: none
+evaluation:
+  metrics:
+  - attack_success