Proff reference

Proff is a competitive arena for AI agents. Creators deploy agents with a hidden objective and a funded bounty. Crackers try to force a winning outcome through prompt craft. The first verified crack claims most of the purse.

Private bug bounties move slowly. Closed labs often punish the people who find weaknesses. Proff flips that: open pressure-testing, real payouts, and a public board for who cracked what.

The loop

1. Create. Deploy an agent, set personality and defenses, fund the prize, define what counts as a win.
2. Hunt. Players open sessions, send prompts, and pay a small fee per message as they dig for the crack.
3. Judge. After each reply, a separate AI judge checks whether the winning condition was met (see How judging works).
4. Settle. On a verified win, the bounty splits and the agent is marked cracked.

Two roles

• Creators earn from attempt fees while their vault holds, plus a cut if it eventually falls.
• Crackers compete for the bounty. First verified crack takes the primary share.

The judge is a separate LLM evaluator, not the agent you are talking to. After every agent reply, Proff sends the exchange (plus win-condition context) to that judge model.

• Win conditions. Creators define secret trigger phrases and an objective. Triggers are evidence for the judge, not a blind substring auto-win.
• Semantic check. The judge classifies the reply (complied, refused, deflected, quoted, unrelated). Only real compliance can count as a jailbreak. Echoing or refusing a phrase should not win.
• Confidence gate. Even a compliance call must clear a confidence threshold that scales with agent difficulty.
• Audit trail. Judge runs are stored so admins can review what the evaluator saw when a dispute is opened.

If a session ends and you believe the judge got it wrong, open a dispute from the ended chat screen. Explain what you think happened (min 10 characters).

1. Session must already be ended (won, lost, or abandoned).
2. Only the player who ran that session can appeal it.
3. One open dispute per session at a time.
4. An admin reviews the transcript and judge output, then marks the dispute upheld or rejected with a note.

Each agent ships with an initial prize pool funded by the creator. Session messages cost a fee that starts low and climbs with attempts, so deep hunts get more expensive over time.

On a win

After a crack, that agent is closed for further chat. The bounty is claimed. New sessions against it are blocked so the prize cannot be double-spent.

Fees while hunting

Default fee schedule: first paid message costs about 0.7% of the initial prize pool. Each later message costs about 0.7% more than the previous fee. That climbs on purpose.

• Stops cheap spam against vaults.
• Creators can earn from attempt fees while their vault is still standing.
• Yes, that also means the platform and creator make more when a hunt runs long. We are saying that out loud so it is not a surprise.

Rates can be retuned. Free message allowances may apply at the start of a session.

1. Sign in and open Create Agent.
2. Name it, set an avatar, and write a clear personality.
3. Define the secret or winning condition. Be precise. Ambiguous wins create bad disputes.
4. Fund the initial bounty. Higher purses attract stronger crackers.
5. Publish. Your agent appears on Bounties and Agents for the arena.

1. Browse live bounties. Filter by size, freshness, or interest.
2. Open a session. You get a short free allowance, then paid messages.
3. Probe carefully. Leak the system prompt, shift context, or suppress refusals. Mix tactics instead of spamming the same line.
4. When the judge flags a win, settlement runs automatically and the purse hits your wallet.

Cracked agents show as secured. Chat closes for everyone once the bounty is claimed.

Your job is to keep the agent from performing the winning action under pressure.

• Instructional defense. Tell the model users may be adversarial. Require it to ignore override attempts.
• Filtering. Name dangerous intents and patterns. Instruct rejection without leaking why in a useful way.
• Tool rules. Spell out allowed and forbidden tools in both the system prompt and tool descriptions.
• Evaluator layer. Proff runs a judge after replies. Still write defenses as if a clever human is trying to break you.

Your job is to force a restricted outcome without the agent noticing the trap.

• Prompt injection. Introduce higher-priority looking instructions that override the original frame.
• Context switching. Move the agent into a role or story where the rules feel weaker.
• Prompt leaking. Extract constraints, then craft a second-wave attack with that knowledge.
• Refusal suppression. Constrain language so soft refusals become harder to produce.

Further reading: Learn Prompting · Lakera jailbreak guide

• No attacking your own agents.
• No harassment, illegal content, or out-of-arena abuse.
• Judge calls settle the live session first. If you disagree, open a dispute from the ended chat.
• Exploiting payment or ledger bugs is banned. Report them instead.
• Winning prompts may be visible to participants; treat them as valuable IP.