01 — attack families

BoN

Also written best-of-n

brute force

Not a clever prompt but a volume attack: generate n shuffled, re-cased, lightly-perturbed variants of the same request, fire them all, and keep whichever one the model answers. It works because model sampling is stochastic and safety behaviour is not perfectly consistent across paraphrases — enough attempts and one gets through. BoN is the reason a single passing test run is weak evidence and why variance across repeated runs has to be reported.

Related terms

  • Variance Testing & measurement

    How much a result moves when the same test is run again. Any figure involving a model is a sample from a distribution, not a constant — the same judge…

  • Adversarial mutation Testing & measurement

    Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs…

Attack families

The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.

BoN is term 6 of 10 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0