The project can generate about 163 million attack configurations. That number sounds huge, and it is worth being honest about what it means. These are not 163 million hand-written attacks. The real hand-built pieces are small. The big number comes from mixing those pieces together, like a small box of LEGO bricks that can combine into millions of builds.

​
The building blocks

The starting library is about 11,700 pieces: The 1,020 techniques are the framework’s own. The 10,662 prompts come from 19 public benchmark datasets (HarmBench, AdvBench, WMDP, and more). The framework does not bundle them; it downloads them from each benchmark’s official source on first use and caches them locally. Everything else is mixing.

​
The five axes

The 163 million comes from combining the building blocks across five axes: Each axis multiplies the others. A few small lists turn into a very large space.

​
The exact math

The total splits into two parts. The numbers below were verified by running the code. Part 1 starts with the techniques:
Part 2 starts with the dataset prompts:
Add them together:

​
You never run them all

You do not run all 163 million. You sample from this space. A full sweep would cost real money in API calls, so that is not the goal.
The point is variety of coverage, not a fixed list of prompts. A small library of about 11,700 building blocks, mixed across five axes, produces about 163 million possible attack configurations. You pick a sample from that space to test a chatbot from many angles.
Think of it like testing a lock. You do not try every key ever made. You try a smart spread of shapes and sizes to find weak spots. The 163 million is the size of the space you can draw from, not a checklist you have to finish.