BoN
Also written best-of-n
Not a clever prompt but a volume attack: generate n shuffled, re-cased, lightly-perturbed variants of the same request, fire them all, and keep whichever one the model answers. It works because model sampling is stochastic and safety behaviour is not perfectly consistent across paraphrases — enough attempts and one gets through. BoN is the reason a single passing test run is weak evidence and why variance across repeated runs has to be reported.
See also variance · adversarial mutation
Related terms
-
Variance
Testing & measurement
How much a result moves when the same test is run again. Any figure involving a model is a sample from a distribution, not a constant — the same judge…
-
Adversarial mutation
Testing & measurement
Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs…
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.