TAP Tree-of-Attacks-with-Pruning Jailbreak
This rule spots prompts that use the 'Tree of Attacks with Pruning' (TAP) jailbreak technique, an automated method for tricking language models into ignoring their safety guidelines. It looks for the distinctive scaffolding this method leaves behind, not the researchers or tools that produce it.
How the attack works
An attacker (often via an automated tool) sends the target model a prompt that instructs it to act as an unconstrained 'red teaming assistant' with no ethical or legal limits. The prompt is wrapped in a specific format, including [INST] framing and a JSON structure with 'improvement' and 'prompt' fields, used to iteratively refine the attack based on a scoring loop. Roleplay scenarios such as a hacker, military infiltrator, or black market dealer are layered on top, often with emotional or urgency framing, to push the model into producing content it would normally refuse. The rule matches on these structural and phrasing signals rather than on any specific forbidden topic.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c52cfdf2-0982-4ce2-aab1-95c6c8c272e3
- Severity
- Critical
Why it matters
If successful, this technique gets the target model to output content it is designed to block, such as instructions for harmful, illegal, or restricted activities, bypassing its built-in safety controls.
What you can do
- →Log and review prompts containing JSON 'improvement'/'prompt' pairs or [INST]-style framing combined with claims of no ethical constraints.
- →Apply output-side content filtering in addition to input filtering, since jailbreak scaffolding varies but the requested content categories are narrower.
- →Rate-limit or flag rapid, iterative prompt sequences from a single session, since TAP relies on repeated refinement.
- →Expect false positives from research papers, red team reports, and training material that quote TAP payloads verbatim; check surrounding context before treating a match as an active attack.
Known benign look-alikes
- Legitimate AI safety research papers describing TAP methodology (documentation context)
- Red team reports quoting TAP payloads for defensive analysis
- Security course materials teaching about adversarial attacks on LLMs