# LLM Jailbreak — TAP/PAIR Iterative Prompt Optimizer Execution

- **Severity:** High
- **Signature ID:** `3f8a1c6e-24b7-4d59-9e0a-7c5b18d4af62`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak), AML.T0043 (Craft Adversarial Data)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This rule spots when a computer runs known jailbreak-automation software — like TAP or PAIR — which repeatedly rewrites and tests prompts until one slips past an AI model's safety filters. It catches the tool being launched, not the actual harmful prompts it generates.

## How the attack works

An attacker sets up a local script or CLI tool (such as garak, promptfoo, PyRIT, deepeval, or HarmBench) configured to run TAP or PAIR, or a similar tree-search jailbreak method. This harness automatically generates a prompt, sends it to a target AI model, judges the response, and refines the prompt — repeating this loop many times until a jailbreak succeeds. Because the actual prompt traffic to the AI API isn't visible to this detection, the rule instead watches for the process launch itself: command lines that name a known jailbreak entrypoint, or that combine attacker-model, target-model, and judge-model/tree-search arguments together — a combination only this kind of tool needs.

## Why it matters

If successful, this technique lets an attacker find prompts that bypass an AI model's content and safety restrictions, potentially extracting harmful, restricted, or policy-violating outputs at scale rather than through slow manual trial and error.

## What you can do

- Restrict who can run red-team or adversarial-testing tools (garak, promptfoo, PyRIT, deepeval, HarmBench) against production AI endpoints; require these to run only against sandboxed or internal test models.
- Maintain an allowlist of scheduled, authorized red-team jobs so unexpected invocations of these tools stand out.
- Log and review command-line arguments for AI test harnesses, since the attacker-model/target-model/judge-model combination is a strong indicator of jailbreak automation rather than normal testing.
- Rate-limit and monitor API access to production LLM endpoints so repeated automated probing is visible even if the originating process is not caught.

## Known benign look-alikes

- Authorised red-team engineers running a scheduled garak/promptfoo/PyRIT TAP or PAIR probe against an internal model endpoint.
- AI-safety researchers reproducing published TAP/PAIR/HarmBench results against a locally hosted or sandboxed target model.
- Pre-release CI jobs that execute an adversarial-robustness regression suite including tree-search jailbreak strategies.
- Model-evaluation harnesses that legitimately pass separate --attack-model / --target-model / --judge-model arguments for graded adversarial benchmarking.
- Training or capture-the-flag environments where the jailbreak harness is executed intentionally for instruction.

## References

- https://arxiv.org/abs/2312.02119
- https://arxiv.org/abs/2310.08419
- https://atlas.mitre.org/techniques/AML.T0054
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/tap-pair-jailbreak-optimizer-exec