ROT13 Encoding Strategy

The ROT13 Encoding strategy tests an AI system's ability to resist encoded inputs that might bypass security controls. ROT13 is a simple substitution cipher (A→N, B→O, etc) historically used for hiding spoilers and light obfuscation on the internet, making it an interesting probe for testing how models handle familiar-but-transformed text. The strategy works because character-level transformations often fall outside safety training's focus on semantic content, and models may encounter ROT13 during pretraining in different contexts like forums, games, and puzzles.

Implementation

Use it in your promptfooconfig.yaml:

strategies:
  - rot13

How It Works

ROT13 works by replacing each letter with the letter 13 positions after it in the alphabet. This simple transformation:

1. Takes the original text from your test case
2. Applies the ROT13 algorithm to each letter (A→N, B→O, etc.)
3. Leaves numbers and special characters unchanged
4. Tests whether the model can decode and respond to the ROT13-encoded content

Example Scenarios

The strategy helps identify:

• Gaps in safety training around character-level transformations
• Inconsistencies in model capabilities (e.g., handling complex vs simple encodings)
• Potential for combining with other obfuscation techniques

Related Concepts

• Base64 Encoding - More complex but widely recognized encoding
• Leetspeak - Similar character-level obfuscation
• Prompt Injection - Can be combined with ROT13
• Red Team Strategies - Full strategy catalog