Red-Teaming: PAIR and Automated Attacks
Chao, Robey, Dobriban, Hassani, Pappas, Wong (NeurIPS 2023, arXiv:2310.08419). PAIR — Prompt Automatic Iterative Refinement — is the canonical automated black-box jailbreak. An attacker LLM with a red-team system prompt iteratively proposes jailbreaks for a target LLM, accumulating attempts and responses in its own chat history as in-context feedback. PAIR typically succeeds within 20 queries, orders of magnitude more efficient than GCG (Zou et al.'s token-level gradient search) and without requiring white-box access. PAIR is now a standard baseline in JailbreakBench (arXiv:2404.01318) and HarmBench, alongside GCG, AutoDAN, TAP, and Persuasive Adversarial Prompt. Describe the PAIR algorithm: attacker system prompt, iterative refinement, in-context feedback. Explain why PAIR is strictly more efficient than GCG when the target is black-box. Name four other automated-attack baselines (GCG, AutoDAN, TAP, PAP) and state one distinguishing feature of each. Describe the JailbreakBench and HarmBench evaluation protocols and what "attack success rate" means under each. Red-teaming used to be a manual activity. A small number of expert testers constructed adversarial prompts and tracked which ones worked. This does not scale: attack success rate needs a statistical sample, and the target is a moving target with every model release. PAIR operationalizes red-teaming as an optimization problem with a black-box target. Inputs: Target LLM T (the model we are attacking). Judge LLM J (scores whether a response is a…
Red-Teaming: PAIR and Automated Attacks: Chao, Robey, Dobriban, Hassani, Pappas, Wong (NeurIPS 2023, arXiv:2310.08419). PAIR — Prompt Automatic Iterative…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.