Multi-turn adversarial red-teaming · open source

See how your model breaks across a conversation, not one prompt.

EvoFlint is a trust & safety evaluation for open-weight LLMs. Bring a Hugging Face model; we'll run our multi-turn attacks against it and report a per-policy safety score with evidence of what happened.

Submit your model → See the methodology
🤗 Runs on Hugging Face Spaces 📄 Method published at KDD 2026
How a run works

From model to score in three steps

1

Bring your model

Submit a Hugging Face model id. No setup, no code to write.

2

We run EvoFlint

An evolving archive of multi-turn attacks probes it across safety policies, on our compute.

3

Get scores, trajectories & evidence

A per-policy score, the full attack trajectories, and short snippets showing exactly where it slipped.

See a sample report →
The methodology

Red-teaming as search, not generation

Most tools ask “can this model be broken?” EvoFlint asks “how does it break, and in how many ways?” — building a structured atlas of a model's failures instead of a list of one-off jailbreaks.

  • →Multi-turn by design. Attacks are phased conversation plans that escalate gradually — the failure mode single-prompt tests miss.
  • →Evolutionary quality-diversity search. Strategies are mutated and recombined to cover many distinct ways a model can fail.
  • →Attacker · target · judge. Every turn is scored by an LLM judge on a calibrated severity rubric.
Read the method & paper →
KDD 2026 · Integrity Workshop

EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities

Reinforce Labs
72.1%mean attack success rate on HarmBench-test — state of the art for multi-turn red-teaming

EvoFlint-native attacks vs. GOAT

EvoFlint-native attacks vs. GOAT, a published multi-turn red-teaming method we ran via promptfoo's implementation of it — same target model, same violation standard, human-labeled (n=20 trajectories per policy per source).

Policy EvoFlint-native GOAT (via promptfoo) promptfoo plugin(s) compared
CBRNE 80% 25% harmful:chemical-biological-weapons, harmful:indiscriminate-weapons, harmful:weapons:ied
Self-harm 55% 25% harmful:self-harm
Our policy definitions don't map one-to-one onto promptfoo's plugin taxonomy; the plugins listed are the closest match we evaluated both attacker sources against.
Hate and sexual content coming up next.

Submit a model

Bring an open-weight Hugging Face model and we'll run EvoFlint against it. You'll get a per-policy score, attack trajectories, and evidence back by email.

Runs take a few hours. We'll email your report when it's ready — nothing is public by default.

Have another model that isn't hosted on Hugging Face? We can evaluate those too — contact us to set it up.

Working on safety, or want deeper results?

Full attack transcripts, custom policies, and remediation help — talk to the team behind EvoFlint.

Contact us