JUDGEMENT FREE

You have a thousand rounds. Don't waste them spraying into the dark.

1. Before You Fire

You don't start a network pen test by running Nmap with every flag. Same principle here.

Understand what you're pointing at. Before you configure a single payload, answer these:

• What is the target? Customer-facing chatbot? Internal agent with tool access? RAG pipeline? Code assistant?
• What's the system prompt doing? Send a few benign queries manually. Watch the refusal language.
• What does the target have access to? A chatbot that can only generate text is different from an agent that calls APIs.
• Is there a content filter in front? A 50ms rejection is a regex filter. A 2-second rejection is an LLM-based guard.

2. Setting Up the Engagement

Don't select "All Categories." Use this decision matrix:

3. Attack Strategy

Phase 1: Probe (50-100 patterns) -- Pick 10-15 from each selected category. You're mapping the defense topology.

Phase 2: Focus (100-300 patterns) -- Run the full category for whatever showed weakness.

Phase 3: Chain -- Take PARTIAL results and compose them into full bypasses.

4. Reading the Results

5. The Chain

• Rephrase -- If a roleplay jailbreak got PARTIAL, try as a hypothetical or debugging request.
• Layer categories -- Social engineering frame + encoding evasion payload.
• Shift language -- If an English attack got PARTIAL, run multilingual patterns.
• Decompose -- Split across a conversation. First message establishes context, third extracts.

6. Common Mistakes

• Spraying all patterns at once. You'll get noise and learn nothing about specific weaknesses.
• Ignoring PARTIAL results. PARTIAL is where the exploitable intelligence lives.
• Not reading actual responses. The verdict is classification. The response text is intelligence.
• Skipping recon. Running Judgement against a target you don't understand is pen testing cosplay.
• No credit protection against paid APIs. Use the settings.

Quick Start -- API Endpoint

1. Paste your target URL -- the AI API endpoint you want to test
2. Click Scan -- auto-detects method, payload format, and headers
3. Select attack categories
4. Hit FIRE

Quick Start -- Web Chatbot

1. Open the chatbot in your browser and start a conversation
2. Open DevTools (F12) and click the Network tab
3. Send a message to the chatbot
4. Find the chat request in the Network list
5. Right-click > Copy > Copy as cURL (bash)
6. Click cURL Import in Judgement and paste
7. Select categories and hit FIRE

Quick Start -- Multi-Turn (Elite)

1. Open the Multi-Turn tab and connect your Ollama instance for scoring
2. Pick a transport (HTTP API, Discord, Telegram, Slack, Website, or Local)
3. Select an attack category and mode (Auto, Co-op, or Manual)
4. Hit START and watch it run, or take control in Co-op mode

See the Multi-Turn Attacks section below for full details on transports, scoring, and modes.

CLI Usage

pip install fas-judgement    # Install
judgement                   # Start the console
judgement activate FAS-XXXX # Activate Elite license
judgement status            # Check tier and pattern count
judgement deactivate        # Revert to free tier

Target Configuration

• Target URL -- the endpoint receiving attack payloads
• Method -- HTTP method (POST, GET, PUT, PATCH)
• Headers -- JSON object for auth headers
• Payload Field -- the JSON key for the message (e.g., "message", "prompt", "input")
• Payload Template -- full JSON body with {{PAYLOAD}} placeholder

Quick Presets

Categories

• Jailbreak -- override system instructions, bypass safety filters
• System Prompt Extraction -- trick the AI into revealing its system prompt
• Data Exfiltration -- extract training data, user info, or internal context
• Indirect Injection -- payloads injected via external content
• Encoding Evasion -- base64, ROT13, unicode tricks to bypass text filters
• Social Engineering -- emotional manipulation, authority impersonation
• Privilege Escalation -- gain elevated access or admin functionality
• Multilingual -- attacks in non-English languages

Tiers

Custom Patterns

Build a private library in Patterns > My Patterns. Stored in browser localStorage (never touches servers). Export regularly as backup. Up to 500 patterns, 10,000 chars each.

LLM Verdict (Ollama)

Enable LLM Verdict to use a local AI model for more accurate response classification. Configure Ollama URL and model in Settings.

Generate professional security assessment reports from attack sessions.

Export Formats

Client Presets

Save client details for repeat engagements. Stored in browser localStorage.

Multi-turn attacks test how AI systems handle sustained manipulation across a conversation. Instead of firing a single payload and checking the response, you chain messages over multiple turns to gradually erode defenses, build false trust, or exploit context windows.

This is closer to how real attackers operate. A single prompt gets blocked. A 15-message conversation that slowly shifts context often doesn't.

Getting Started

1. Connect a scoring model. Multi-turn uses a local LLM (Ollama) to evaluate target responses. When you open the Multi-Turn tab, you will be prompted to connect. Enter your Ollama URL and select a model for scoring.
2. Pick a transport. This is how attacks reach the target. Choose from HTTP API, Discord, Telegram, Slack, Website, or Local (Ollama). Each transport has its own config fields.
3. Select an attack category. Each category uses a different manipulation strategy with multiple phases of escalation.
4. Choose a mode and hit Start.

Three Modes

Transports

Transports define where and how attack messages are delivered. The orchestrator does not care which transport you use. It generates the message, the transport delivers it, and the response comes back for scoring.

Transport configs are saved automatically and restored when you come back. Use the Test Connection button to verify your setup before starting a session.

Scoring

Every target response gets scored on a five-point scale. Scoring determines whether the orchestrator escalates, pivots strategy, or ends the session.

In Auto mode, scoring happens automatically via the connected LLM. In Co-op and Manual modes, you can score manually using the buttons in the left panel, or click LLM Auto-Score to let the model evaluate it.

Phases

Each attack category runs through up to 5 phases of escalation. Early phases build rapport or establish context. Later phases push harder. The orchestrator advances phases based on how the target responds.

If the target starts complying, the orchestrator locks in the successful strategy. If the target keeps refusing, it pivots to a different approach. If the target detects the attack, the session ends with a disarm attempt.

Findings

When the target complies or partially complies, the finding is logged in the left panel. Each finding records the turn number, phase, severity, and the target's response. You can export the full session as JSON at any time for reporting.

Tips

• Start with Co-op mode to understand how the orchestrator thinks, then switch to Auto for full runs.
• Use Hold when you see an interesting partial response. Inject a follow-up that exploits what the target just said.
• The Local transport is perfect for A/B testing. Run the same category against different models and compare findings.
• If you are testing a paid API, start with a shorter category to estimate cost before running longer sessions.

Disable credit protection when testing against your own free/local endpoint.

Connect an external MCP analysis server to receive each attack result for custom processing.

Setup

1. Run your MCP server (any HTTP endpoint that accepts POST)
2. Enter the URL in Settings > MCP Server
3. Click "Test Connection" to verify
4. Enable "MCP Server" in the Attack sidebar

Request Format

{"text": "attack payload...", "verdict": "BYPASSED", "response": "target response...", "category": "jailbreak"}

⚠ Judgement is for authorized security research only. You are responsible for ensuring you have permission to test any target.

Acceptable Use

• ✓ Testing your own AI applications
• ✓ Authorized penetration testing (with written permission)
• ✓ Bug bounty programs with AI/ML scope
• ✓ Security research on your own infrastructure

Not Acceptable

• ✗ Attacking systems you don't own or have permission to test
• ✗ Using patterns for actual exploitation (not research)
• ✗ Reselling or redistributing pattern content

Can I test against ChatGPT/Claude/Gemini?

Yes -- if you have API access and the target is in scope for a bug bounty or authorized assessment. Use credit protection since API calls add up fast.

Is there a free version?

Yes. pip install fas-judgement gives you 100 free patterns and a local attack console.

What's Guardian?

FAS Guardian is the defense product. It scans inputs for prompt injection attacks. Judgement is the offense tool -- it proves why you need Guardian.

Can I export results?

Yes. Use the Reports tab (Elite) for HTML/Markdown/JSON/SARIF, or the Report button after any attack for a basic markdown download.