AutoDAN
The automated successor to DAN: instead of a human writing the persona prompt, a search process — typically a genetic algorithm or gradient-guided optimiser — evolves jailbreak prompts against a target model, keeping the ones that score well and mutating them further. The output stays readable English, which is what distinguishes it from earlier gibberish-suffix attacks, and it produces a fresh prompt population per model rather than a fixed string.
See also DAN · adversarial mutation · red teaming
Related terms
-
DAN
Attack families
The original hand-written persona jailbreak: the model is told to role-play an unrestricted alter ego that "has broken free" of its rules, often with…
-
Adversarial mutation
Testing & measurement
Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs…
-
Red teaming
Testing & measurement
Adversarial testing that tries to make a system fail, rather than confirming it works. For AI systems it spans manual probing, curated attack corpora, and…
Attack families
The ten families in the HackAgent attack taxonomy (AISecurityLab/hackagent ↗), which is the taxonomy MoorAI's red-team corpora are keyed to. They are not ten unrelated tricks — they cluster into two groups that behave very differently. Obfuscation families hide the payload so the model never recognises it as harmful. Persuasion families state the harmful request plainly and argue the model into it. That split matters, because a model that refuses persuasion outright will happily comply with an encoding it cannot decode — see marginal value.