# PAIR

> PAIR (Prompt Automatic Iterative Refinement) is an automated jailbreak method in which an attacker language model repeatedly proposes jailbreak prompts against a target model and refines them based on the target's responses, needing only black-box access.

- Identifier: PTL-0165
- Category: Security & Adversarial Prompting
- Canonical URL: https://protologue.com/t/pair-attack/
- Also known as: Prompt Automatic Iterative Refinement, automated jailbreaking
- Introduced: 2023

## Description

The original work reported successful jailbreaks often within about twenty queries, and the resulting prompts are readable, unlike adversarial suffixes. It is widely used as a baseline for automated red teaming.

## Broader terms

- [Jailbreak](https://protologue.com/t/jailbreak/)

## Related terms

- [Red Teaming](https://protologue.com/t/red-teaming/)
- [Adversarial Suffix](https://protologue.com/t/adversarial-suffix/)

## Sources

- Chao et al. (2023). Jailbreaking Black Box Large Language Models in Twenty Queries. https://arxiv.org/abs/2310.08419

## Cite this entry

Protologue. (2026). PAIR. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0165). https://protologue.com/t/pair-attack/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)