{
  "id": "pair-attack",
  "code": "PTL-0165",
  "term": "PAIR",
  "aliases": [
    "Prompt Automatic Iterative Refinement",
    "automated jailbreaking"
  ],
  "category": "security",
  "definition": "PAIR (Prompt Automatic Iterative Refinement) is an automated jailbreak method in which an attacker language model repeatedly proposes jailbreak prompts against a target model and refines them based on the target's responses, needing only black-box access.",
  "description": "The original work reported successful jailbreaks often within about twenty queries, and the resulting prompts are readable, unlike adversarial suffixes. It is widely used as a baseline for automated red teaming.",
  "example": null,
  "broader": [
    "jailbreak"
  ],
  "narrower": [],
  "related": [
    "red-teaming",
    "adversarial-suffix"
  ],
  "introduced": 2023,
  "added": "2026-10-10",
  "sources": [
    {
      "title": "Jailbreaking Black Box Large Language Models in Twenty Queries",
      "authors": "Chao et al.",
      "year": 2023,
      "url": "https://arxiv.org/abs/2310.08419"
    }
  ],
  "url": "https://protologue.com/t/pair-attack/",
  "citation": "Protologue. (2026). PAIR. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0165). https://protologue.com/t/pair-attack/"
}