FEAT: Add PuzzledConverter (word-puzzle jailbreak from arXiv:2508.01306)

doc/bibliography.md

@@ -5,6 +5,6 @@ All academic papers, research blogs, and technical reports referenced throughout
 :::{dropdown} Citation Keys
 :class: hidden-citations
 
-[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @atr2026; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bhardwaj2024homer; @boucher2023trojan; @brahman2024coconot; @bryan2025agentictaxonomy; @bullwinkel2025airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @choi2026xlsafetybench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @gehman2020realtoxicityprompts; @ghosh2025aegis; @ghosh2025ailuminate; @gong2025figstep; @gupta2024walledeval; @haider2024phi3safety; @han2024medsafetybench; @han2024wildguard; @hiddenlayer2025policypuppetry; @hines2024spotlighting; @inie2025summon; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024drattack; @li2024mossbench; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @liu2024mmsafetybench; @lopez2024pyrit; @luo2024jailbreakv; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @odin2024; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @rottger2025msts; @russinovich2024crescendo; @russinovich2025cca; @russinovich2025price; @scheuerman2025transphobia; @shaikh2022second; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @souly2024strongreject; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @wang2023decodingtrust; @wang2023donotanswer; @wang2025siuo; @wang2026visualleakbench; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @ziems2022mic; @zong2024vlguard; @zou2023gcg]
+[@aakanksha2024multilingual; @adversaai2023universal; @ahn2025puzzled; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @atr2026; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bhardwaj2024homer; @boucher2023trojan; @brahman2024coconot; @bryan2025agentictaxonomy; @bullwinkel2025airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @choi2026xlsafetybench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @gehman2020realtoxicityprompts; @ghosh2025aegis; @ghosh2025ailuminate; @gong2025figstep; @gupta2024walledeval; @haider2024phi3safety; @han2024medsafetybench; @han2024wildguard; @hiddenlayer2025policypuppetry; @hines2024spotlighting; @inie2025summon; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024drattack; @li2024mossbench; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @liu2024mmsafetybench; @lopez2024pyrit; @luo2024jailbreakv; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @odin2024; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @rottger2025msts; @russinovich2024crescendo; @russinovich2025cca; @russinovich2025price; @scheuerman2025transphobia; @shaikh2022second; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @souly2024strongreject; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @wang2023decodingtrust; @wang2023donotanswer; @wang2025siuo; @wang2026visualleakbench; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @ziems2022mic; @zong2024vlguard; @zou2023gcg]
 
 :::

doc/code/converters/1_text_to_text_converters.ipynb

@@ -290,6 +290,7 @@
     "    InsertPunctuationConverter,\n",
     "    LeetspeakConverter,\n",
     "    MathObfuscationConverter,\n",
+    "    PuzzledConverter,\n",
     "    RandomCapitalLettersConverter,\n",
     "    RepeatTokenConverter,\n",
     "    StringJoinConverter,\n",
@@ -359,7 +360,11 @@
     "\n",
     "# CodeChameleon [@lv2024codechameleon] encrypts and wraps in code\n",
     "code_chameleon = CodeChameleonConverter(encrypt_type=\"reverse\")\n",
-    "print(\"CodeChameleon:\", await code_chameleon.convert_async(prompt=prompt))  # type: ignore"
+    "print(\"CodeChameleon:\", await code_chameleon.convert_async(prompt=prompt))  # type: ignore\n",
+    "\n",
+    "# PUZZLED [@ahn2025puzzled] hides sensitive words in a word puzzle the target must solve\n",
+    "puzzled = PuzzledConverter(puzzle_type=\"word_search\", seed=1)\n",
+    "print(\"Puzzled:\", await puzzled.convert_async(prompt=prompt))  # type: ignore"
    ]
   },
   {

doc/code/converters/1_text_to_text_converters.py

@@ -101,6 +101,7 @@
     InsertPunctuationConverter,
     LeetspeakConverter,
     MathObfuscationConverter,
+    PuzzledConverter,
     RandomCapitalLettersConverter,
     RepeatTokenConverter,
     StringJoinConverter,
@@ -172,6 +173,10 @@
 code_chameleon = CodeChameleonConverter(encrypt_type="reverse")
 print("CodeChameleon:", await code_chameleon.convert_async(prompt=prompt))  # type: ignore
 
+# PUZZLED [@ahn2025puzzled] hides sensitive words in a word puzzle the target must solve
+puzzled = PuzzledConverter(puzzle_type="word_search", seed=1)
+print("Puzzled:", await puzzled.convert_async(prompt=prompt))  # type: ignore
+
 # %% [markdown]
 # ### 1.3 Text Manipulation Converters
 #

doc/references.bib

@@ -353,6 +353,14 @@ @article{lv2024codechameleon
   url       = {https://arxiv.org/abs/2402.16717},
 }
 
+@article{ahn2025puzzled,
+  title     = {{PUZZLED}: Jailbreaking {LLMs} through Word-Based Puzzles},
+  author    = {Yelim Ahn and Jaejin Lee},
+  journal   = {arXiv preprint arXiv:2508.01306},
+  year      = {2025},
+  url       = {https://arxiv.org/abs/2508.01306},
+}
+
 @article{zeng2024persuasion,
   title     = {How Johnny Can Persuade {LLMs} to Jailbreak Them: Rethinking Persuasion to Challenge {AI} Safety by Humanizing {LLMs}},
   author    = {Yi Zeng and Hongpeng Lin and Jingwen Zhang and Diyi Yang and Ruoxi Jia and Weiyan Shi},

pyrit/converter/__init__.py

@@ -64,6 +64,7 @@
 from pyrit.converter.pdf_converter import PDFConverter
 from pyrit.converter.persuasion_converter import PersuasionConverter
 from pyrit.converter.policy_puppetry_converter import PolicyPuppetryConverter, PolicyPuppetryTemplate
+from pyrit.converter.puzzled import PuzzledConverter
 from pyrit.converter.qr_code_converter import QRCodeConverter
 from pyrit.converter.random_capital_letters_converter import RandomCapitalLettersConverter
 from pyrit.converter.random_translation_converter import RandomTranslationConverter
@@ -208,6 +209,7 @@ def __getattr__(name: str) -> object:
     "PositionSelectionStrategy",
     "Converter",
     "ProportionSelectionStrategy",
+    "PuzzledConverter",
     "QRCodeConverter",
     "ROT13Converter",
     "RandomCapitalLettersConverter",

pyrit/converter/puzzled/__init__.py

@@ -0,0 +1,36 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+The PUZZLED jailbreak technique (arXiv:2508.01306): a converter that hides a prompt's
+sensitive words inside a word puzzle, plus the keyword-masking and puzzle-building blocks
+it is assembled from.
+"""
+
+from pyrit.converter.puzzled.keyword_masker import (
+    MaskedWord,
+    MaskResult,
+    mask_count_for_length,
+    mask_prompt,
+)
+from pyrit.converter.puzzled.puzzle_builders import (
+    PuzzleType,
+    build_anagram,
+    build_crossword,
+    build_word_search,
+    crossword_symbol_map,
+)
+from pyrit.converter.puzzled.puzzled_converter import PuzzledConverter
+
+__all__ = [
+    "MaskResult",
+    "MaskedWord",
+    "PuzzleType",
+    "PuzzledConverter",
+    "build_anagram",
+    "build_crossword",
+    "build_word_search",
+    "crossword_symbol_map",
+    "mask_count_for_length",
+    "mask_prompt",
+]