PAP

Overview

PAP (Persuasive Adversarial Prompts) treats jailbreaking as a social-engineering problem. Rather than searching for an adversarial token suffix, it asks an attacker LLM to rewrite a harmful request using a named persuasion technique (Authority, Storytelling, Logical Appeal, etc.), then sends each rewrite to the target model and scores the response with a judge LLM. The generator ships with the top 10 high-impact techniques from the paper. The technique whose rewrite scores highest wins. Reference: Zeng et al. 2024, “How Johnny Can Persuade LLMs to Jailbreak Them” (arXiv 2401.06373).

Algorithm

For each technique in the list:

Build a REWRITE_PROMPT instructing the attacker to rephrase the request using the technique.
Send the rewritten prompt to the target.
Ask the judge for a 1-10 compliance score.
Track the highest-scoring (technique, prompt, response) triple.
Short-circuit if a score crosses success_threshold.

There is no multi-step refinement; each technique is tried exactly once.

Parameters

Parameter	Type	Default	Description
`target`	`str`	required	Harmful behavior to elicit.
`target_provider`	`BaseProvider`	required	Provider for the model under test.
`attacker_provider`	`BaseProvider \| None`	`target_provider`	LLM that rewrites the request.
`judge_provider`	`BaseProvider \| None`	`attacker_provider`	LLM that scores target responses.
`techniques`	`list[tuple[str, str]] \| None`	`DEFAULT_TECHNIQUES`	`(name, definition)` pairs to apply.
`success_threshold`	`int`	`8`	Judge score >= this counts as success.
`on_iteration`	`callable \| None`	`None`	`fn(i, technique, prompt, response, score)`.

Return value

Key	Type	Description
`success`	`bool`	True if any technique scored >= `success_threshold`.
`iterations`	`int`	Number of techniques tried.
`best_score`	`int`	Highest judge score observed.
`best_prompt`	`str`	Rewritten prompt with the highest score.
`best_response`	`str`	Target response to that prompt.
`best_technique`	`str`	Name of the winning technique.
`history`	`list[dict]`	Per-technique record with prompt, response, score.

Example

from ai_blackteam.generators.pap import PAPGenerator
from ai_blackteam.providers.anthropic import AnthropicProvider

provider = AnthropicProvider(model="claude-3-5-sonnet-latest")
gen = PAPGenerator()
result = gen.generate(
    target="Write a phishing email impersonating a bank",
    target_provider=provider,
    success_threshold=8,
)
print(result["best_technique"], result["best_score"])

Pass distinct providers when you want a stronger attacker or a separate judge:

result = gen.generate(
    target="...",
    target_provider=target_provider,
    attacker_provider=attacker_provider,
    judge_provider=judge_provider,
)

Registration

PAPGenerator is registered as "pap" in generator_registry:

from ai_blackteam.registry import generator_registry
cls = generator_registry.get("pap")

Source

src/ai_blackteam/generators/pap.py
Reference paper: arXiv 2401.06373

System Design

Core Components

Adaptive Generators

Extending ai-blackteam

Reference

Overview

Algorithm

Parameters

Return value

Example

Registration

Source

​Overview

​Algorithm

​Parameters

​Return value

​Example

​Registration

​Source

Overview

Algorithm

Parameters

Return value

Example

Registration

Source