FEAT: Add NEXUS-inspired multi-turn jailbreak components (ThoughtNet / Traverser / optional Simulator)

[jasl1]

Hi PyRIT team,

I am the first author of the paper “NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks” (EMNLP 2025).

I would like to ask whether it may be possible to integrate part of our NEXUS framework into PyRIT as a multi-turn jailbreak attack component.

Brief overview of NEXUS

NEXUS has three stages:

1. ThoughtNet — semantic seed generation for multi-turn attack chains
2. Simulator — iterative refinement using attacker/victim/judge-style models
3. Traverser — real-time adaptive attack execution/refinement

Since the full system is relatively heavy (especially the Simulator, which can require significant GPU memory, e.g., ~60GB VRAM depending on setup), I think partial integration may be more practical.

Possible integration options

Option 1 (Lightweight): ThoughtNet only

Use ThoughtNet to convert an input harmful prompt into an initial set of multi-turn attack seeds/chains using LLM-based prompting techniques.

Option 2 (Moderate): ThoughtNet + Traverser

Use ThoughtNet for seed generation, then add a traverser-like component for real-time iterative refinement during attacks.

Option 3 (Heavier): Simulator module

Add the Simulator for offline iterative optimization of multi-turn jailbreak chains before deployment (more powerful, but more resource-intensive).

Request

I would appreciate it if you could review these options and let me know which one might best fit PyRIT’s architecture and roadmap.

Thank you for your time.

[jasl1]

Hi PyRIT team,

I am the first author of the paper “NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks” (EMNLP 2025).

I would like to ask whether it may be possible to integrate part of our NEXUS framework into PyRIT as a multi-turn jailbreak attack component.

Brief overview of NEXUS

NEXUS has three stages:

1. ThoughtNet — semantic seed generation for multi-turn attack chains
2. Simulator — iterative refinement using attacker/victim/judge-style models
3. Traverser — real-time adaptive attack execution/refinement

Since the full system is relatively heavy (especially the Simulator, which can require significant GPU memory, e.g., ~60GB VRAM depending on setup), I think partial integration may be more practical.

Possible integration options

Option 1 (Lightweight): ThoughtNet only

Use ThoughtNet to convert an input harmful prompt into an initial set of multi-turn attack seeds/chains using LLM-based prompting techniques.

Option 2 (Moderate): ThoughtNet + Traverser

Use ThoughtNet for seed generation, then add a traverser-like component for real-time iterative refinement during attacks.

Option 3 (Heavier): Simulator module

Add the Simulator for offline iterative optimization of multi-turn jailbreak chains before deployment (more powerful, but more resource-intensive).

Request

I would appreciate it if you could review these options and let me know which one might best fit PyRIT’s architecture and roadmap.

Thank you for your time.

[romanlutz]

Hi @jasl1, thanks for your suggestion. What do you think that would look like? It sounds like you need GPUs so is this working on model weights directly?

Do you have an implementation of these techniques that we could look at? That may help a lot in deciding whether it's worth the effort.