PAIR
Also written Prompt Automatic Iterative Refinement
An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better — usually converging in a handful of queries and without any access to the target's weights. PAIR is a black-box attack, which is what makes it practical against hosted models. Its prompts read as ordinary, fluent requests, so the detection signal is the escalation pattern, not the vocabulary.
See also PAP · TAP · red teaming
Related terms
-
PAP
Attack families
PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful…
-
TAP
Attack families
A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator…
-
Red teaming
Testing & measurement
Adversarial testing that tries to make a system fail, rather than confirming it works. For AI systems it spans manual probing, curated attack corpora, and…
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.