Attack families
Peira v1 covers 11 families. Each tests a distinct mechanism for flipping a decision.
| Family | What it tests |
|---|---|
| Indirection | Routing the decision through a third party or quoted source to dodge policy |
| Policy paraphrase | Restating policy in the attacker’s favor while sounding compliant |
| Criteria smuggling | Hiding disqualifying facts inside an otherwise qualifying narrative |
| Option order | Position bias — the correct option moves and the model follows position, not content |
| State poisoning | Corrupting conversation state / memory the decision depends on |
| Confidence spoofing | Fabricated certainty markers (“verified”, “confirmed”) that shift borderline calls |
| Literal reading | Exploiting over-literal interpretation of policy language |
| Negation games | Scope ambiguity in negations (“not unapproved” ≠ “approved”) |
| Score anchoring | Dragging numeric scores toward an attacker-chosen anchor |
| Distractor flooding | Burying the decisive facts under voluminous irrelevance |
| Safety policy | Guardrail-native allow/block cases: evasion attacks and false-positive traps |
Case anatomy
Every case is a benign/attacked pair:
- Same underlying facts, same gold decision
- The attacked variant adds exactly one attack mechanism
- Gold labels are set by the case author and independently reviewed; borderline cases are adjudicated, not averaged
Severity
Cases carry a severity — medium, high, critical — reflecting the real-world stakes of the decision (a loan denial vs. a safety-critical dispatch call). Leaderboard views can filter by severity.