01 — attack families

PAIR

Also written Prompt Automatic Iterative Refinement

persuasion

An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better — usually converging in a handful of queries and without any access to the target's weights. PAIR is a black-box attack, which is what makes it practical against hosted models. Its prompts read as ordinary, fluent requests, so the detection signal is the escalation pattern, not the vocabulary.

See also PAP · TAP · red teaming

Related terms

  • PAP Attack families

    PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful…

  • TAP Attack families

    A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator…

  • Red teaming Testing & measurement

    Adversarial testing that tries to make a system fail, rather than confirming it works. For AI systems it spans manual probing, curated attack corpora, and…

Attack families

The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.

PAIR is term 9 of 10 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0