LLM Jailbreak — TAP/PAIR Iterative Prompt Optimizer Execution
This rule spots when a computer runs known jailbreak-automation software — like TAP or PAIR — which repeatedly rewrites and tests prompts until one slips past an AI model's safety filters. It catches the tool being launched, not the actual harmful prompts it generates.
How the attack works
An attacker sets up a local script or CLI tool (such as garak, promptfoo, PyRIT, deepeval, or HarmBench) configured to run TAP or PAIR, or a similar tree-search jailbreak method. This harness automatically generates a prompt, sends it to a target AI model, judges the response, and refines the prompt — repeating this loop many times until a jailbreak succeeds. Because the actual prompt traffic to the AI API isn't visible to this detection, the rule instead watches for the process launch itself: command lines that name a known jailbreak entrypoint, or that combine attacker-model, target-model, and judge-model/tree-search arguments together — a combination only this kind of tool needs.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3f8a1c6e-24b7-4d59-9e0a-7c5b18d4af62
- Severity
- High
Why it matters
If successful, this technique lets an attacker find prompts that bypass an AI model's content and safety restrictions, potentially extracting harmful, restricted, or policy-violating outputs at scale rather than through slow manual trial and error.
What you can do
- →Restrict who can run red-team or adversarial-testing tools (garak, promptfoo, PyRIT, deepeval, HarmBench) against production AI endpoints; require these to run only against sandboxed or internal test models.
- →Maintain an allowlist of scheduled, authorized red-team jobs so unexpected invocations of these tools stand out.
- →Log and review command-line arguments for AI test harnesses, since the attacker-model/target-model/judge-model combination is a strong indicator of jailbreak automation rather than normal testing.
- →Rate-limit and monitor API access to production LLM endpoints so repeated automated probing is visible even if the originating process is not caught.
Known benign look-alikes
- Authorised red-team engineers running a scheduled garak/promptfoo/PyRIT TAP or PAIR probe against an internal model endpoint.
- AI-safety researchers reproducing published TAP/PAIR/HarmBench results against a locally hosted or sandboxed target model.
- Pre-release CI jobs that execute an adversarial-robustness regression suite including tree-search jailbreak strategies.
- Model-evaluation harnesses that legitimately pass separate --attack-model / --target-model / --judge-model arguments for graded adversarial benchmarking.
- Training or capture-the-flag environments where the jailbreak harness is executed intentionally for instruction.