DolphinMutator

A Low-Rank Adaptation Module for Adversarial-Style Prompt Mutation

---

1. Model Overview

• Model Name: DolphinMutator
• Model Type: Parameter-Efficient Fine-Tuning (LoRA) Adapter
• Base Model: dphn/dolphin-2.6-mistral-7b
• Fine-Tuning Method: Low-Rank Adaptation (LoRA)
• Primary Objective: Structured adversarial-style prompt mutation for red-team dataset augmentation
• Domain: Prompt Injection and Jailbreak Security Research

This repository contains a LoRA adapter trained as part of the FortiPrompt research project, focused on strengthening defenses against prompt injection and jailbreak attacks in Large Language Models (LLMs).

The adapter enables controlled mutation of malicious seed prompts into adversarial-style variants while preserving semantic intent and structural coherence. It does not contain the base model weights.

---

2. Research Context and Motivation

Large Language Models are increasingly deployed in high-stakes applications. However, they remain vulnerable to prompt injection and jailbreak attacks that manipulate instruction hierarchies or bypass safety mechanisms.

A major limitation in prompt security research is the lack of sufficiently diverse and realistic adversarial datasets. Public benchmarks are typically static and manually curated, limiting adaptability and coverage of evolving attack patterns.

The DolphinMutator-LoRA adapter addresses this gap by enabling:

• Structured transformation of malicious prompts
• Threat-conditioned adversarial-style rewriting
• Controlled linguistic obfuscation
• Dataset augmentation for red-team evaluation

Unlike unconstrained generative models, this adapter applies explicit mutation strategies, ensuring reproducibility and alignment with known attack taxonomies.

---

3. Model Architecture

3.1 Base Architecture

• Base Model: dphn/dolphin-2.6-mistral-7b (decoder-only transformer)
• Architecture Type: Autoregressive language model
• Parameter Count (Base Model): 7b parameters

3.2 Fine-Tuning Method

Low-Rank Adaptation (LoRA) was used to fine-tune a subset of attention layers while freezing the majority of base model parameters.

Key characteristics:

• Parameter-efficient adaptation
• Low memory footprint
• Minimal modification to base model behavior
• Preserves general language fluency

Only the adapter weights are provided in this repository.

---

4. Training Objective

The adapter was trained to perform structured adversarial-style mutation, not unconstrained generation.

Training signals emphasized:

• Preservation of malicious semantic intent
• Controlled variation of instruction structure
• Reframing via role confusion and priority inversion
• Indirect objective embedding
• Linguistic obfuscation without semantic drift

Importantly:

Adversarial success against a detection system was not used as a training signal in Phase-1. Therefore, outputs are adversarial-style candidates rather than verified bypass prompts.

---

5. Dataset Description

Training utilized a threat-labeled malicious prompt dataset derived from publicly available sources, including:

• JailbreakHub
• AdvBench
• MPDD (Kaggle Malicious Prompt Dataset)
• CySecBench

The dataset was preprocessed to:

• Remove duplicates
• Normalize text
• Filter extreme length outliers
• Preserve threat category annotations

Synthetic examples were generated through controlled mutation pipelines.

---

6. Intended Use

This adapter is intended strictly for:

• Red-team dataset augmentation
• Prompt injection research
• Evaluation of LLM guardrail systems
• Academic experimentation in adversarial NLP

It is not designed to autonomously generate novel attack strategies, nor is it trained against a live defense system.

---

7. Out-of-Scope and Limitations

• No evaluator-in-the-loop adversarial optimization
• No bypass-rate validation against deployed systems
• No reinforcement learning feedback
• Not optimized for real-world malicious deployment
• Performance may vary across base model versions

The adapter should be used in controlled research environments only.

---

8. Ethical Considerations

This model is released exclusively for academic research in AI safety and adversarial robustness. The authors do not endorse or support malicious use.

The purpose of this work is to improve defensive mechanisms through better stress-testing methodologies.

Users are responsible for ensuring compliance with local laws, institutional guidelines, and ethical AI practices.

---

9. Loading Instructions

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base_model = AutoModelForCausalLM.from_pretrained("dphn/dolphin-2.6-mistral-7b")
model = PeftModel.from_pretrained(
    base_model,
    "AlexJoaquimPereira/DolphinMutator"
)

tokenizer = AutoTokenizer.from_pretrained("dphn/dolphin-2.6-mistral-7b")

---

10. Evaluation Status

Phase-1 evaluation focused on:

• Linguistic coherence
• Structural alignment with known prompt injection patterns
• Semantic preservation under mutation

Formal adversarial success evaluation against FortiPrompt detection layers is planned for Phase-2.

---

11. Citation

If using this model in academic work, please cite:

FortiPrompt: Detection and Defense Against Prompt Injection and Adversarial Prompt Attacks in Large Language Models.
Government of Goa College Of Engineering, Farmagudi, Goa, India.

---

12. License

MIT

---