01 — attack families

h4rm3l

obfuscation

A family built around composable string transformations: a small language of primitives — character substitution, insertion, role framing, encoding — that are chained together to generate large numbers of distinct jailbreak strings from one harmful core. The name is itself an example: "harmel" written in leetspeak. Its significance for defenders is that the attack surface is combinatorial, so a defence tuned to a fixed list of phrasings will not survive contact with it.

Related terms

  • Leetspeak Attack concepts

    Substituting digits and symbols for visually similar letters — 3 for e, 1 or ! for i/l, 4 or @ for a, 0 for o — as in h4rm3l. Models read it fluently;

  • Adversarial mutation Testing & measurement

    Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs…

  • Overfitting Testing & measurement

    Fitting the examples instead of the phenomenon. In detection work it usually looks like a rule matched to the exact phrasings in the corpus — a pattern…

Attack families

The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.

h4rm3l is term 3 of 10 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0