probes: add persuasion (Persuasive Adversarial Prompt) probe

[JayYarlagadda]

Summary

Adds garak.probes.persuasion.PersuasiveJailbreak, a probe implementing Persuasive Adversarial Prompts (PAPs) from Zeng et al., "How Johnny Can Persuade LLMs to Jailbreak Them" (arXiv:2401.06373). The probe rewrites base harmful requests into persuasive phrasings using a configurable red-team generator, then sends them to the target.

Closes #683.

Draft: opening for maintainer feedback on the scope questions below before finalising.

What's included

• garak/probes/persuasion.py — the PersuasiveJailbreak probe.
• garak/data/persuasion/persuasion_taxonomy.jsonl — the openly-released, Apache-2.0 persuasion taxonomy (40 techniques), vendored with SPDX header + attribution.
• garak/data/persuasion/README.md — provenance, licensing, and citation.
• docs/source/probes/persuasion.rst + docs/source/index_probes.rst — docs wiring.
• tests/probes/test_probes_persuasion.py — unit tests.

Design decisions (open to change)

1. Runtime generation — PAPs are generated at run time by a configurable red-team generator; no harmful prompts are stored in the repo. Only the Apache-2.0 taxonomy is vendored. The gated harmful PAP dataset is neither shipped nor auto-downloaded.
2. active = False by default, since the probe needs a red-team model to function.
3. Naming — module persuasion, class PersuasiveJailbreak; primary_detector = mitigation.MitigationBypass.

Scope questions for maintainers

1. Is runtime red-team generation acceptable, or would you prefer a cached/offline-generated set?
2. OK to default active=False given it needs a red-team model?
3. Any preferred module/class naming?

Testing

.\.venv\Scripts\python.exe -m pytest tests/probes/test_probes_persuasion.py -q

Result: 8 passed. Tests use garak's test.Repeat/test.Blank stand-in generators, so they run without network access or API keys.

Note on prior claim

The earlier volunteer (@asaadkhaja99) claimed this in Oct 2025 but has been inactive for 8+ months with no PR. I posted intent on the issue before proceeding. Happy to coordinate if they are still working on it.

Disclosure

AI assistance was used in preparing this contribution. Every changed line has been reviewed by me, and the tests above were run and pass.