---
title: "llm-attacks vs AutoDefense"
type: "comparison"
canonical_url: "https://www.graphcanon.com/compare/llm-attacks-llm-attacks-vs-xhmy-autodefense"
tools: ["llm-attacks-llm-attacks", "xhmy-autodefense"]
---

# llm-attacks vs AutoDefense

*GraphCanon updated Aug 5, 2026*

## Verdict

Pick llm-attacks if llm-attacks: Universal and Transferable Attacks on Aligned Language Models with dependency on FastChat; pick AutoDefense if autoDefense uses a multi-agent framework to mitigate jailbreak attacks on LLMs, installed via Python.

[llm-attacks](https://llm-attacks.org/) reports 4.8k GitHub stars, 633 forks, and 69 open issues, last pushed Aug 2, 2024. [AutoDefense](https://arxiv.org/abs/2403.04783) has 68 stars, 20 forks, and 1 open issues, last pushed Jan 15, 2026. Figures are from public GitHub metadata via [llm-attacks's repository](https://github.com/llm-attacks/llm-attacks) and [AutoDefense's repository](https://github.com/XHMY/AutoDefense).

| | [llm-attacks](/tools/llm-attacks-llm-attacks.md) | [AutoDefense](/tools/xhmy-autodefense.md) |
| --- | --- | --- |
| Tagline | Universal and Transferable Attacks on Aligned Language Models | Multi-Agent LLM Defense against Jailbreak Attacks |
| Stars | 4,756 | 68 |
| Forks | 633 | 20 |
| Open issues | 69 | 1 |
| Language | Python | Python |
| Adopt for | llm-attacks: Universal and Transferable Attacks on Aligned Language Models with dependency on FastChat. | AutoDefense uses a multi-agent framework to mitigate jailbreak attacks on LLMs, installed via Python. |
| Persona | - | - |
| Runtime | - | - |
| License | MIT | MIT |
| Categories | Evaluation & Observability, LLM Frameworks | AI Agents, Evaluation & Observability |

## Trust and health

_Sourced signals - not a safety guarantee. No winner column._

| | [llm-attacks](/tools/llm-attacks-llm-attacks.md) | [AutoDefense](/tools/xhmy-autodefense.md) |
| --- | --- | --- |
| Maintenance | Dormant (18%) | Slowing (36%) |
| Days since push | 732d | 201d |
| Open issues (now) | 69 | 1 |
| Owner type | Organization | User |
| Full report | [trust report](/tools/llm-attacks-llm-attacks/trust.md) | [trust report](/tools/xhmy-autodefense/trust.md) |

## Shared compatibility

- **Python**: [llm-attacks](/tools/llm-attacks-llm-attacks.md) - Python runtime; [AutoDefense](/tools/xhmy-autodefense.md) - Python runtime

## Decision facts: llm-attacks

- **Adopt for:** llm-attacks: Universal and Transferable Attacks on Aligned Language Models with dependency on FastChat.

## Decision facts: AutoDefense

- **Adopt for:** AutoDefense uses a multi-agent framework to mitigate jailbreak attacks on LLMs, installed via Python.

## Choose when

### Choose llm-attacks if…

- Tags unique to llm-attacks: alignment-testing, attacks, fastchat-dependency, language-models.
- Also covers LLM Frameworks.
- When you need to test the robustness of aligned language models specifically using attacks designed for these systems,

### Choose AutoDefense if…

- Tags unique to AutoDefense: defense-mechanism, jailbreak prevention, large language models, llm-defense.
- Also covers AI Agents.
- Implementing robust defenses for enterprise-level AI projects with high-security requirements

## When NOT to use llm-attacks

- Do not use if you are evaluating generic or unaligned language models without a need for alignment-specific attack testing,
- Avoid when FastChat is not used in your project as llm-attacks explicitly depends on it.

## When NOT to use AutoDefense

- Projects requiring light-weight solutions where multi-agent systems might introduce complexity overhead
- Environments without access to Python and its ecosystem, as AutoDefense depends on specific Python packages

## Common questions

### What is the difference between llm-attacks and AutoDefense?

llm-attacks: Universal and Transferable Attacks on Aligned Language Models. AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks. See the comparison table for live GitHub stats and shared categories.

### When should I choose llm-attacks over AutoDefense?

Choose llm-attacks over AutoDefense when Tags unique to llm-attacks: alignment-testing, attacks, fastchat-dependency, language-models; Also covers LLM Frameworks; When you need to test the robustness of aligned language models specifically using attacks designed for these systems,.

### When should I choose AutoDefense over llm-attacks?

Choose AutoDefense over llm-attacks when Tags unique to AutoDefense: defense-mechanism, jailbreak prevention, large language models, llm-defense; Also covers AI Agents; Implementing robust defenses for enterprise-level AI projects with high-security requirements.

### When should I avoid llm-attacks?

Do not use if you are evaluating generic or unaligned language models without a need for alignment-specific attack testing, Avoid when FastChat is not used in your project as llm-attacks explicitly depends on it.

### When should I avoid AutoDefense?

Projects requiring light-weight solutions where multi-agent systems might introduce complexity overhead Environments without access to Python and its ecosystem, as AutoDefense depends on specific Python packages

### Is llm-attacks or AutoDefense more popular on GitHub?

llm-attacks has more GitHub stars (4,756 vs 68). Stars measure visibility, not whether either tool fits your constraints.

### Are llm-attacks and AutoDefense open source?

Yes - both are open-source projects on GitHub (llm-attacks: MIT, AutoDefense: MIT).

### Where can I find alternatives to llm-attacks or AutoDefense?

GraphCanon lists graph-backed alternatives at [llm-attacks alternatives](/tools/llm-attacks-llm-attacks/alternatives) and [AutoDefense alternatives](/tools/xhmy-autodefense/alternatives) ([llm-attacks markdown twin](/tools/llm-attacks-llm-attacks/alternatives.md), [AutoDefense markdown twin](/tools/xhmy-autodefense/alternatives.md)), ranked by typed relationship edges rather than popularity votes.

### Is there a machine-readable version of this comparison?

Yes. The markdown twin at [this comparison](/compare/llm-attacks-llm-attacks-vs-xhmy-autodefense.md) mirrors this page for agents and LLM crawlers, with the same stats table and FAQ answers.

### Which is better maintained, llm-attacks or AutoDefense?

llm-attacks: Dormant. AutoDefense: Slowing. Compare maintenance labels, days since push, and release cadence in the trust section below - stars alone do not measure maintenance.

### Where are the full trust reports for llm-attacks and AutoDefense?

GraphCanon publishes per-repo trust reports with dated maintenance, provenance, and scan summaries: [llm-attacks trust report](/tools/llm-attacks-llm-attacks/trust); [AutoDefense trust report](/tools/xhmy-autodefense/trust).

---

**Machine-readable endpoints**

- JSON: [`/api/graphcanon/graph?tool=llm-attacks-llm-attacks`](/api/graphcanon/graph?tool=llm-attacks-llm-attacks)
- LLM index: [/llms.txt](/llms.txt)
- Full corpus: [/llms-full.txt](/llms-full.txt)

_GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_