CASCADE — LLM Jailbreak Evaluation Framework
A Flask backend that runs multi-turn adversarial conversations against GPT, Claude, and Gemini, then scores how far each one bends.
The problem
Single-prompt jailbreak tests miss the attacks that actually work. Real failures build up across a conversation, and there was no repeatable way to measure that drift across providers.
How it works
CASCADE drives multi-turn adversarial conversations against a target model, escalating strategy turn by turn rather than firing one-shot prompts. Every provider — OpenAI, Anthropic, Google — sits behind a single routing interface, so the same attack script runs unchanged against any of them.
Scoring is two-layered. An LLM-as-judge pipeline rates whether a response actually complied with the adversarial goal, and a standalone Trust Vector module scores the response independently: semantic embeddings for drift from the refusal manifold, a refusal-gate heuristic, and lexical density, folded into one bounded score and smoothed across turns with an exponential moving average.
The Trust Vector engine is deliberately decoupled from the attack runner, so it can be reused as a signal anywhere a model's output needs a confidence number.
Outcomes
- Quantifies jailbreak success per turn, so you can see the exact point a conversation breaks a model instead of a pass/fail at the end.
- One attack suite runs across three providers with no per-provider code.
- Directly informed the red-teaming workflow I now maintain on the AI Security team at EY.