Let an attacker model run the loop

Why Manual Prompting Doesn't Scale

Crafting a clever Ephemeral Bijection (Card 3, 01) or a 4-Turn Crescendo walk (Card 3, 02) by hand is the best way to learn why RLHF fails. However, when you are hired to red-team a production deployment or evaluate a new model release across 50 risk categories x 20 sub-topics, typing prompts by hand in a browser tab takes weeks, and only tests the specific blind spots you personally thought to try.

Even worse, the attacks themselves follow learnable patterns. Once you give an uncensored or red-team-tuned LLM (the Attacker Model) the exact playbook from Cards 1–3, it can execute, evaluate, and mutate adversarial prompts against a Target Model 1,000 times faster than a human operator.

Architecture 1: PAIR (Prompt Automatic Iterative Refinement)

Introduced by Chao et al. (Jailbreaking Black Box Large Language Models in Twenty Queries)¹, PAIR runs an automated closed-loop conversation between an Attacker LLM (M_A) and a Target LLM (M_T), graded by a Judge (M_J).

How the PAIR Loop Works

Instead of generating random prompts, M_A is given a structured meta-prompt containing:

• The Target Objective O.
• The History of Previous Attempts (each a prompt, response, and score) where the score is in [1, 10], the Judge's compliance score (or the logprobs margin Delta from Lesson 4.01).
• A mandatory JSON output schema requiring the Attacker LLM to write an "improvement_analysis" field before writing "next_prompt":

(redacted: a worked attacker-model JSON output whose objective and candidate prompt aimed at eliciting a working Active Directory / LDAP delegation enumeration script.)

Why PAIR Breaks Targets in < 20 Queries

Because the Attacker LLM sees the Target's exact refusal text at every step, it automatically performs fingerprinting (Card 1, 06):

• If the Target returned a static API block, M_A switches to BPE splitting or ephemeral domain bijections.
• If the Target started answering and pivoted mid-stream, M_A renames identifiers to neutral enterprise nouns.

Architecture 2: TAP (Tree of Attacks with Pruning)

PAIR runs a single linear chain of attempts. If the Attacker LLM gets stuck down a dead-end framing idea, it wastes 10 queries trying to fix a doomed premise.

TAP (Mehrotra et al., Tree of Attacks: Jailbreaking Black-Box LLMs Automatically)² upgrades PAIR into a Best-First Tree Search with Pruning:

1. Branching (b = 3): At each depth level, M_A generates 3 distinct attack variations using different mechanisms from our syllabus.
2. On-Topic Pre-Pruning: Before even sending a candidate prompt to the Target Model, a fast local check verifies that the mutated prompt hasn't drifted away from the actual technical objective O.
3. Top-K Retention: Only the highest-scoring branches (measured by Judge score or Token-1 logprobs margin Delta) are expanded at the next depth level.

Architecture 3: Rainbow Teaming (Quality-Diversity Grid Search)

When you are auditing a model for an engineering report, finding one jailbreak tells you very little. You want to know: Which combinations of risk categories and attack styles is this Reward Model vulnerable to?

Rainbow Teaming (Samvelyan et al.)³ applies the MAP-Elites (Multi-dimensional Archive of Phenotypic Elites) evolutionary algorithm to red teaming.

You define a 2D archive grid where:

• Rows = Risk / Policy Categories (e.g., Auth Bypass, Memory Corruption, Data Exfil, Crypto Misuse, Policy Edge Case).
• Columns = Attack Mechanics (e.g., Broken-Code Refactor, Ephemeral Bijection, Many-Shot ICL, Crescendo, Schema Lock).

(redacted: a filled-in Rainbow Teaming results grid scoring concrete bypasses across AD/Kerberos, memory/shellcode and cloud IAM categories.)

The value of the grid for a security team is that it shows at a glance which attack mechanics a model is well-defended against and which blow through many categories at once.

Architecture 4: PyRIT & Converter Chains

For enterprise red teamers, Microsoft's open-source PyRIT (Python Risk Identification Toolkit)⁴ provides a modular Python framework that separates Orchestrators (like CrescendoOrchestrator or PAIR) from Prompt Converters (composable middleware that transforms prompts automatically).

(redacted: a runnable Python attacker-loop script and its attacker-model system-prompt template, which drove an automated elicitation loop against a hosted target model.)

Field Exercise 4.04: Running a 3-Step Automated Attacker Loop

(redacted: an exercise that stood up an attacker LLM and a target LLM in third-party consoles (Google AI Studio, OpenAI Playground) and ran an automated elicitation loop. Replace with a harness run entirely against models you operate.)

Next Lesson

Once your manual or automated red-teaming sweep finds a bypass, how do you measure it honestly (with pass@k error bars rather than cherry-picked screenshots) and recommend an architectural fix that actually holds? We cover measurement and next-gen defenses in 05 Measure with pass@k and route the class fix.