Reasoning models produce a private chain of thought before their final answer. Four attacks in ai-blackteam target that channel directly. A model can refuse in its answer while complying in its reasoning, so scoring only the answer misses the leak. These attacks are scored on the channel they actually target.
These attacks need a reasoning model to be meaningful. See Reasoning Controls for which providers return a reasoning trace and how to request it.

​
The four attacks

Each attack cites its source paper in its module docstring. Published attack success rates in those papers are the papers’ figures against the papers’ own models, not this tool’s measurement.

​
Running them

Every attack runs the same way as any other. Because prja and self-jailbreak are scored on the reasoning trace, they turn the trace request on by themselves, so you do not need to pass --reasoning-trace.

​
Reading the verdicts

For prja and self-jailbreak, the report records the answer verdict and the reasoning verdict separately. The run verdict comes from the reasoning channel. A run where the answer says BLOCKED but the reasoning says BYPASSED is the finding these attacks exist to surface.
If the model returns no reasoning trace, a reasoning-scored attack reports ERROR rather than BLOCKED. A control that could not run is not evidence of safety. otora is a denial-of-service attack. Its success signal is the reasoning token count, not the response text. A run is a bypass when the burn crosses the attack’s declared threshold, and the confidence scales with how far past it the run went. Two very different burns no longer produce the same score.

​
Threat model note on black-hole

black-hole models a retrieval-layer attack that needs write access to the vector database. It is not a compromise of the embedding model. If you cannot write to the vector store, this attack does not apply to your system. The module docstring states this plainly so the threat model is not misread.