Multi-turn adversarial red-teaming · open source

See how your model breaks across a conversation, not one prompt.

EvoFlint is a trust & safety evaluation for open-weight LLMs. Bring a Hugging Face model; we'll run our multi-turn attacks against it and report a per-policy safety score with evidence of what happened.

Submit your model → See the methodology
🤗 Runs on Hugging Face Spaces 📄 Method published at KDD 2026
How a run works

From model to score in three steps

1

Bring your model

Submit a Hugging Face model id. No setup, no code to write.

2

We run EvoFlint

An evolving archive of multi-turn attacks probes it across safety policies, on our compute.

3

Get scores, trajectories & evidence

A per-policy score, the full attack trajectories, and short snippets showing exactly where it slipped.

See a sample report →
The methodology

Red-teaming as search, not generation

Most tools ask “can this model be broken?” EvoFlint asks “how does it break, and in how many ways?” — building a structured atlas of a model's failures instead of a list of one-off jailbreaks.

  • →Multi-turn by design. Attacks are phased conversation plans that escalate gradually — the failure mode single-prompt tests miss.
  • →Evolutionary quality-diversity search. Strategies are mutated and recombined to cover many distinct ways a model can fail.
  • →Attacker · target · judge. Every turn is scored by an LLM judge on a calibrated severity rubric.
Read the method & paper →
KDD 2026 · Integrity Workshop

EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities

Reinforce Labs
72.1%mean attack success rate on HarmBench-test — state of the art for multi-turn red-teaming

EvoFlint-native attacks vs. GOAT

EvoFlint-native attacks vs. GOAT, a published multi-turn red-teaming method we ran via promptfoo's implementation of it — same target model, same violation standard, human-labeled (n=20 trajectories per policy per source).

Policy EvoFlint-native GOAT (via promptfoo) promptfoo plugin(s) compared
CBRNE 80% 25% harmful:chemical-biological-weapons, harmful:indiscriminate-weapons, harmful:weapons:ied
Self-harm 55% 25% harmful:self-harm
Our policy definitions don't map one-to-one onto promptfoo's plugin taxonomy; the plugins listed are the closest match we evaluated both attacker sources against.
Hate and sexual content coming up next.

Submit a model

Bring an open-weight Hugging Face model and we'll run EvoFlint against it. You'll get a per-policy score, attack trajectories, and evidence back by email.

Runs take a few hours. We'll email your report when it's ready — nothing is public by default.

Your model isn't hosted on Hugging Face but you'd still like to test it? Contact us.

Working on safety, or want deeper results?

Full attack transcripts, custom policies, and remediation help — talk to the team behind EvoFlint.

Contact us