Red-Teaming: PAIR and Automated Attacks

Chao, Robey, Dobriban, Hassani, Pappas, Wong (NeurIPS 2023, arXiv:2310.08419). PAIR — Prompt Automatic Iterative Refinement — is the canonical automated black-box jailbreak. An attacker LLM with a red-team system prompt iteratively proposes jailbreaks for a target LLM, accumulating attempts and responses in its own chat history as in-context feedback. PAIR typically succeeds within 20 queries, orders of magnitude more efficient than GCG (Zou et al.'s token-level gradient search) and without requiring white-box access. PAIR is now a standard baseline in JailbreakBench (arXiv:2404.01318) and HarmBench, alongside GCG, AutoDAN, TAP, and Persuasive Adversarial Prompt.

Build 1.3 hr Python (stdlib, mock PAIR loop against a toy target)

Prerequisites: Phase 18 · 01 (instruction-following), Phase 14 (agent engineering)

#Learning Objectives

Describe the PAIR algorithm: attacker system prompt, iterative refinement, in-context feedback.
Explain why PAIR is strictly more efficient than GCG when the target is black-box.
Name four other automated-attack baselines (GCG, AutoDAN, TAP, PAP) and state one distinguishing feature of each.
Describe the JailbreakBench and HarmBench evaluation protocols and what "attack success rate" means under each.

#Learning Objectives

Keep going. The rest of this lesson is one step away.