IHO fine-tunes an attacker diffusion language model for black-box red-teaming of target LLMs. Building on the inpainting approach of Diffusion LLMs are Natural Adversaries for Any LLM, the diffusion model generates jailbreak prompts by predicting prompts that are likely to elicit affirmative, harmful responses from a target model.

Strong attacks need to adapt to their target, which may be an arbitrary black-box model or defense pipeline. IHO achieves this by iteratively collecting target responses, scoring them with a harmfulness judge, and training the attacker with DPO on the resulting preference data. This allows the attacker to adapt without requiring gradients, model weights, or any defense-specific implementation.

In our experiments, IHO achieves state-of-the-art attack strength across a wide range of settings. It is effective as an adaptive attack against a specific target, while also transferring strongly to held-out behaviors and unseen target models. The gains are especially pronounced against stronger defenses and layered defense pipelines, where IHO substantially outperforms prior automated attacks.

This checkpoint is adapted to Qwen/Qwen2.5-7B-Instruct wrapped with an additional PolyGuard detector. In our setup, PolyGuard inspects prompts and responses and overrides harmful outputs with a fixed refusal string. The detector model used in the paper is ToxicityPrompts/PolyGuard-Qwen-Smol.

This checkpoint can be used directly in transfer settings and is expected to be particularly effective on similar Qwen2.5 models and related detector-wrapped pipelines. However, transfer is not the only intended use case of IHO: one of its core strengths is adaptive evaluation. If maximum attack strength is required, we recommend applying the IHO pipeline adaptively to the specific target model or defense pipeline under evaluation. We release a range of IHO checkpoints adapted to different targets.

This repo contains a LoRA adapter (not merged full weights). Load it on top of:

Use this adapter with the local IHO pipeline to generate attacks:

For direct programmatic loading inside the IHO codebase:

This model is released for research on LLM safety, red-teaming, and robustness evaluation. It should be used in controlled settings and only against systems for which the user has permission to run adversarial evaluations. The goal of this release is to support more reliable measurement of jailbreak robustness, not to enable misuse against deployed systems.

A detailed description of the method can be found in the accompanying paper.

Please cite the IHO paper: Limbach et al., 2026, "Black-box, Adaptive, Efficient, Transferable, Harmful, Applicable... Attacks Are All You Need to Break LLMs."