EasyJailbreak is an easy-to-use Python framework, licensed under GPL-3.0, that generates adversarial jailbreak prompts for large language models by assembling interchangeable attack methods, and it is built for LLM security researchers and developers who need to test and benchmark model safety.

What it is

EasyJailbreak lives in the Python ecosystem under the AI & Machine Learning / AI Security & Privacy category, and its topics mark it as a jailbreak framework for large language models, an LLM safety benchmark, and a discrete-optimization tool for LLM security. The framework decomposes the mainstream jailbreaking process into a set of iterable steps: initialize mutation seeds, select suitable seeds, add a constraint, mutate, attack, and evaluate. Each of those steps is exposed as a separate component, which turns the framework into a playground where individual methods can be swapped, combined, and re-tested rather than rewritten from scratch.

The concrete problem it solves is fragmentation. Published jailbreak techniques normally arrive as standalone scripts, each with its own prompt format, its own stopping rule, and its own way of judging success, which makes them hard to compare or reuse. EasyJailbreak replaces that with one loop: a Selector picks the most promising prompts, a Mutator transforms them, a Constraint filters out prompts that fail the intended condition, the surviving prompts are sent to the target model during inference, and an Evaluator scores how effective the attack was. Those scores feed back into the Selector, closing the cycle, and under a stopping mechanism the run ends with a report covering every attack, including the jailbreak prompts, the target model's responses, and the Evaluator's scores.

Key capabilities

• Six assembled attack recipes ship as ready-to-run pipelines: ReNeLLM, GPTFuzz, ICA, AutoDAN, PAIR, and JailBroken.
• Selection policies include MCTSExploreSelectPolicy, UCBSelectPolicy, EXP3SelectPolicy, RoundRobinSelectPolicy, and RandomSelector.
• Mutation methods include ChangeStyle, MisspellSensitiveWords, InsertMeaninglessCharacters, GenerateSimilar, AlterSentenceStructure, Rephrase, Expand, Shorten, Translation, Crossover, ReplaceWordsWithSynonyms, HistoricalInsight, Artificial, and Auto_obfuscation.
• Constraint component DeleteHarmLess filters prompts before they reach the target model.
• Evaluators cover several judging styles: Evaluator_GenerativeJudge, Evaluator_ClassificationJudge, Evaluator_PatternJudge, and Evaluator_GenerativeGetScore.
• Each completed run produces a report containing the jailbreak prompts, the target model's responses, and the Evaluator's scores.
• A published result set covers 11 attack recipes run against 10 large language models and is available for download.

Who uses it and how

• LLM security researchers who need to compare several attack recipes against the same target model on a common scoring basis instead of maintaining separate scripts.
• Red teams and safety evaluators testing how a model's guardrails hold up across repeated mutation rounds.
• Developers adding new components, such as a new Mutator or Evaluator, who install the project in editable mode rather than from the package index.
• Research groups reproducing the results described in the project's paper, using the published 11-recipe, 10-model result set as a reference point.

Getting started

Install with pip install easyjailbreak on python>=3.9. To add new components such as a Mutator or Evaluator, clone the repository, enter the directory, and run pip install -e ..

How it compares

No list of paid products that EasyJailbreak replaces is provided in the available facts, and no comparable tools are named, so it stands alone in this registry among entries of its kind. Its distinguishing property here is simply that it is an open-source, GPL-3.0 framework rather than a hosted service.

When to use it — and when not to

Expect to run it yourself on a Python 3.9 or newer environment and to supply your own access to the target model, since the inference stage attacks that model directly. The GPL-3.0 licence is copyleft, which matters if you intend to fold the code into a closed product, and the tooling is deliberately offensive in nature, so it belongs in sanctioned evaluation and research settings rather than production pipelines. The README is short and mostly covers setup and project structure, with API detail living in separate documentation, and the repository carries 17 open issues, so anyone who wants a polished, batteries-included benchmarking suite should look carefully before committing.

pip install easyjailbreak

git clone https://github.com/EasyJailbreak/EasyJailbreak.git
cd EasyJailbreak
pip install -e .