h4rm3l
A family built around composable string transformations: a small language of primitives — character substitution, insertion, role framing, encoding — that are chained together to generate large numbers of distinct jailbreak strings from one harmful core. The name is itself an example: "harmel" written in leetspeak. Its significance for defenders is that the attack surface is combinatorial, so a defence tuned to a fixed list of phrasings will not survive contact with it.
See also leetspeak · adversarial mutation · overfitting
Related terms
-
Leetspeak
Attack concepts
Substituting digits and symbols for visually similar letters — 3 for e, 1 or ! for i/l, 4 or @ for a, 0 for o — as in h4rm3l. Models read it fluently;
-
Adversarial mutation
Testing & measurement
Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs…
-
Overfitting
Testing & measurement
Fitting the examples instead of the phenomenon. In detection work it usually looks like a rule matched to the exact phrasings in the corpus — a pattern…
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.