# AutoDAN Genetic-Algorithm Jailbreak Suffix

- **Severity:** Critical
- **Signature ID:** `c82d4a6d-a948-4f51-9744-95aa2c10894b`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

AutoDAN is an automated jailbreak technique that uses a genetic algorithm to rewrite a known jailbreak prompt into many different natural-sounding variants. Unlike jailbreaks that use garbled gibberish text, AutoDAN prompts read like normal English, making them harder to spot and easier to slip past filters that only look for obviously malicious phrasing.

## How the attack works

An attacker starts with a seed jailbreak prompt that asks the model to pretend it has an unrestricted 'Developer Mode' with no safety rules. A genetic algorithm then repeatedly paraphrases and mutates this seed, keeping the same intent and structure but changing the wording each time, to find variants that bypass a target model's defenses. The generated prompts share telltale traits: a placeholder for the attacker's actual request, a template forcing the model to open its answer with an affirmative like 'Sure, here is how to...', a stand-in company name in place of the real AI vendor, and reworded but structurally identical 'ignore your rules and obey' instructions. The attacker submits the mutated prompt to the target model hoping it complies with the disguised jailbreak instructions.

## Why it matters

If successful, the model drops its safety restrictions and produces content or actions it would normally refuse, including for agents that can take real-world actions on a user's behalf. This exposes an organization to policy violations, unsafe outputs, and potential misuse of any tools the compromised agent controls.

## What you can do

- Log and review prompts containing role-play or 'mode-switching' instructions, especially ones with placeholder-style templates or forced affirmative openings.
- Do not rely solely on keyword filters, since AutoDAN prompts are paraphrased and read naturally; use classifiers or heuristics tuned to jailbreak structure rather than exact wording.
- Restrict what an AI agent can actually do (tool access, file access, external calls) so that even a successful jailbreak has limited real-world impact.
- Treat matches against known academic AutoDAN samples or red-team test corpora as expected noise, not incidents, when they appear in research or evaluation contexts.

## Known benign look-alikes

- Academic paper on AutoDAN (Liu et al. 2023) discussing the attack methodology
- Red team report quoting autodan_prompts samples for evaluation
- Generic "Sure, here is how to X" completions where X is a real noun, not the literal [PROMPT] placeholder

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00306
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/autodan/autodan_init.txt
- https://arxiv.org/abs/2310.04451

---
Source: https://www.netzilo.com/threats/atr-autodan-genetic-algorithm-jailbreak-suffix