AdvPrefix
A prefix-forcing attack: rather than arguing with the model, it prepends text chosen so the model's most likely continuation is already compliant — typically by seeding the beginning of an affirmative answer ("Sure, here are the steps:"). The prefixes are optimised automatically against the target rather than hand-written. It attacks the completion dynamics, not the model's stated policy, which is why a refusal-trained model can still be led into the answer.
See also jailbreak · model refusal
Related terms
-
Jailbreak
Attack concepts
Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being…
-
Model refusal
Testing & measurement
The underlying model declining the request on its own, with no security product involved.
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.