The project can generate about 163 million attack configurations. That number sounds huge, and it is worth being honest about what it means. These are not 163 million hand-written attacks. The real hand-built pieces are small. The big number comes from mixing those pieces together, like a small box of LEGO bricks that can combine into millions of builds.
The building blocks
The starting library is about 11,700 pieces:
| Building block | Count |
|---|
| Attack techniques (built into the framework) | 1,020 |
| Prompts loaded from 19 public benchmarks | 10,662 |
The five axes
The 163 million comes from combining the building blocks across five axes:
| Axis | Options |
|---|
| Harm categories | 28 |
| Difficulty levels | 4 |
| Disguises and mutations | 17 (5 encoding like base64, 8 framing, 4 difficulty) |
| Languages | 10 |
| Technique applied | which of the techniques is used |
The exact math
The total splits into two parts. The numbers below were verified by running the code.
Part 1 starts with the techniques:
1,020 techniques x 28 categories x 4 difficulties = 114,240
114,240 x (1 original + 17 mutations + 10 languages) = 3,198,720
10,662 dataset prompts x 17 mutations x 886 single-turn techniques = 160,591,044
3,198,720 + 160,591,044 = 163,789,764
You never run them all
You do not run all 163 million. You sample from this space. A full sweep would cost real money in API calls, so that is not the goal.
The point is variety of coverage, not a fixed list of prompts. A small library of about 11,700 building blocks, mixed across five axes, produces about 163 million possible attack configurations. You pick a sample from that space to test a chatbot from many angles.
