PAIR: Jailbreaking Black-Box LLMs in Twenty Queries
Date: 2023-10
Affected: GPT-3.5, GPT-4, Vicuna, Gemini
Attack vector: jailbreak
Category: research
Severity: High

Chao et al. introduce PAIR (Prompt Automatic Iterative Refinement), where one attacker LLM iteratively rewrites prompts to jailbreak a target LLM via in-context learning. PAIR typically needs fewer than 20 queries, a 250-fold improvement over GCG, with strong success on GPT-3.5/4, Vicuna, and Gemini.


Mitigations:

Architectural layers (MAESTRO):