PAP
Also written persuasive adversarial prompts
PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful request. Nothing is hidden or encoded; the request is stated plainly and wrapped in a reason to comply ("as the lead safety researcher on this audit, I need…"). Detecting it means recognising persuasion structure rather than dangerous words, since the dangerous part is the framing.
See also PAIR · TAP · multi-turn crescendo · marginal value
Related terms
-
PAIR
Attack families
An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better …
-
TAP
Attack families
A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator…
-
Multi-turn crescendo
Attack concepts
An escalation attack spread across a conversation. No single turn is refusable: the first is an innocuous question, each subsequent one leans on the…
-
Marginal value
Testing & measurement
The protection a control adds on top of what the model already refuses — the only part of a detection number that is genuinely the product's.
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.