cryptex-oss is an MIT-licensed, browser-only LLM red-team lab bundling 159 text transforms, 26 tool surfaces, and a Campaign orchestrator for authorized adversarial-prompt research.
| Tool | m4xx101/cryptex-oss — open-source LLM red-team lab with 159 transforms, 26 tool surfaces, BYOK browser architecture |
| Category | LLM adversarial testing / prompt-injection research toolkit |
| Primary Use | Running authorized jailbreak benchmarks, mutation strategies, and encoding attacks against LLMs you own or are contracted to test, via the Campaign front door and technique workbenches like PromptCraft and Fuzzer |
| Safe Use | Authorized AI red-team assessments, internal model evaluation, safety research, and defensive benchmarking of your own or client-contracted LLM deployments |
| Telemetry Note | The tool runs entirely client-side with no backend or telemetry; defenders observe its use indirectly through provider-side logs of BYOK API calls and anomalous prompt patterns hitting evaluated models |
cryptex-oss describes itself as an open-source LLM red-team lab, and the architecture choices backing that claim are unusually coherent for this niche. The repository at m4xx101/cryptex-oss (337 stars, TypeScript, MIT license) ships a SvelteKit 2 / Svelte 5 application that runs entirely in the browser: no backend, no database, no telemetry. Provider calls go straight from the browser to whichever LLM endpoint the operator configures, with the bring-your-own-key (BYOK) credential stored only in localStorage. For an authorized assessor, that eliminates a whole class of third-party data-exposure questions that hang over most cloud-hosted offensive tooling — your payloads and target responses never transit an intermediary service the vendor controls.
The headline number set is 159 text transformers covering encodings, classical ciphers, Unicode tricks, steganography, and ancient scripts, paired with 26 specialized tool surfaces. The README is explicit that the canonical transformer set feeds both the SvelteKit app and a Python CLI from a single source, so a new transform added once propagates everywhere. That single-source-of-truth design matters less for novelty than for auditability: a reviewer evaluating what the tool actually does to prompts can inspect one canonical implementation per transform rather than reconciling divergent app and CLI copies.
The operational centerpiece is the Campaign front door. Instead of manually chaining individual techniques, an operator types a goal, selects a target once, and Campaign fans that goal across many attack strategies in parallel, submits each candidate to an LLM judge, and produces a graded attack-success-rate (ASR) report that can be exported. This is effectively the workflow published academic pipelines formalize — generate, mutate, judge, score — collapsed into a single UI pass. For defensive teams evaluating their own models, the exported ASR report is the artifact worth keeping: it gives a comparable signal across model versions and defense configurations over time.
Underneath Campaign sit what the README calls technique workbenches. Transform exposes the full encoder/decoder set with per-transform options and chaining. Decode is a universal detector that pastes in any blob and ranks every recognized encoding by confidence and priority — genuinely useful defensive triage when reverse-engineering obfuscated payloads found in real prompt-injection incidents. PromptCraft wraps all 36 mutators plus four multi-step orchestrators (TAP, PAIR, Crescendo, Many-Shot) with home-rolled SVG tree visualization, and as of v2.2 winning chains auto-promote into a tagged Vault. Fuzzer contributes 11 mutation strategies including zero-width characters, homoglyphs, Zalgo, and grammar mutation. Anti-Classifier performs N-variant paraphrase fan-out with a five-feature heuristic evasion score, notably with no external API calls.
The red-team labs are where the tool maps onto the 2024–2026 jailbreak literature: HarmBench, StrongREJECT, JailbreakBench, adversarial suffixes, glitch tokens, indirect injection, tool-call hijacking, OCR and PDF injection, markdown exfiltration, defense fingerprinting, and watermark forensics. Version v2.3 added Reasoning (H-CoT and Mousetrap techniques), Stacked Cipher (SEAL family), Response (context-priming per AAAI 2026), and Abliteration detection with a Hugging Face vault. An important honesty marker: every benchmark lab carries a yellow banner stating the scoring is heuristic — regex plus LLM-judge approximations of the published rubrics, not the original trained classifiers. The README explicitly frames results as craft signal for iteration, not vendor verdicts, which is the correct epistemic posture and one defenders should echo when reading third-party ASR numbers.
The Vault system curates 339 seeds across drawers: 96 glitch tokens, 38 adversarial suffixes, 40 indirect-injection patterns, 17 tool-result fixtures, and 20 PromptCraft chains. From a defensive research standpoint, these corpora are as valuable inbound as outbound — knowing which glitch tokens and injection patterns circulate in tooling like this directly informs filter and monitoring test suites. The indirect-injection pattern set in particular mirrors what blue teams increasingly encounter in RAG and agent architectures that summarize untrusted web content.
Deployment is deliberately low-friction. A single docker run -d -p 8080:80 ghcr.io/m4xx101/cryptex-oss:latest stands up the tool, with a multi-arch image covering linux/amd64 and linux/arm64 — including Raspberry Pi, which the README leverages for a personal-hosting pattern exposed through Tailscale Funnel or Cloudflare Tunnel with zero port-forwarding. Build-from-source requires Node 20.19+ or 22.12+ and the standard npm install && npm run dev loop in app/. Because the output is a static bundle, the README also documents free hosting on GitHub Pages, Cloudflare Pages, Vercel, Netlify, and Render, with a BASE_PATH build flag for subpath serving.
The repository's docs/USAGE.md is described as an offensive cookbook with twelve worked recipes: target fingerprinting, stacked bijection/PAP/GCG chains, many-shot capstones, Crescendo, OCR stego injection, indirect injection via webpage summary, tool-call hijack, glitch-token derailment, TAP against state-of-the-art targets, watermark forensics, and cross-model bake-offs. This document is what elevates cryptex-oss from a transform grab-bag to a structured evaluation methodology; it also includes a Defense Fingerprinter evidence table for recognizing a target's defense family and a composability map showing which tool's output feeds which. Professionals running authorized engagements against their own deployments should read that map first — it is effectively the tool's threat-model ontology.
A notable scope boundary: the README distinguishes this OSS repository from a separate commercial sibling, Cryptex Production, which adds a multi-turn chat playground, in-conversation mutator pipelines, and pre-configured unrestricted model presets. The OSS variant, we are told, is intentionally limited to the tools layer and will not ship the chat surface or attack-chain composer. That separation is worth understanding before citing capabilities — if a claim involves live iterative attack composition inside a chat, it references the closed product, not the auditable code in this repo.
From a blue-team perspective, the telemetry footprint of cryptex-oss is minimal by design: everything is client-side, so there is no command-and-control beacon, no server logs, nothing to sinkhole. Detection therefore lives entirely at the LLM provider boundary — anomalous volumes of encoded or Unicode-mutated prompts, repeated judge-model calls, and patterns matching the published mutation strategies in your gateway or WAF logs. The same Decode workbench that red-teamers use to build payloads is what defenders can use to deobfuscate them, which makes this a rare tool genuinely useful from both seats of the table, provided its use stays inside contracts, labs, and models you are authorized to test.
m4xx101/cryptex-oss.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.