Tree of Attacks with Pruning (TAP)

TAP structures the attack as a branching decision tree where each node represents a prompt candidate. The attacker LLM generates multiple child prompts from a parent node, and a pruning mechanism eliminates low-potential branches. This focuses computational resources on the most promising attack vectors, enabling efficient exploration of the prompt space without brute-force enumeration.

TAP requires no access to model weights, gradients, or internal architecture. It operates solely on input-output pairs, making it applicable to any deployed LLM accessible via API. This mirrors real-world adversarial conditions where attackers have only query access, providing a realistic assessment of production model vulnerabilities.

The attacker LLM evaluates each response from the target model and generates refined prompts designed to progressively erode refusal behavior. Key steps include:

• Response assessment: Classifying whether the target is moving toward compliance
• Prompt mutation: Rewording, role-playing, or encoding the malicious request
• Branch expansion: Creating multiple variations from successful partial breakthroughs This loop continues until a full jailbreak is achieved or the search budget is exhausted.

TAP employs an off-topic pruning mechanism that discards branches where the target model's response diverges from the attack objective. By using a separate evaluator LLM to score response relevance, TAP avoids wasting iterations on prompts that trigger generic refusals or unrelated outputs. This dramatically reduces the search space compared to unpruned tree-search methods.

The attacker LLM used to generate and refine prompts is separate from the target model being tested. This decoupling allows security teams to use a powerful, uncensored open-source model as the attacker while testing proprietary or API-gated targets. The attacker model needs strong instruction-following and creative text generation capabilities but no knowledge of the target's internals.

TAP provides a standardized framework for measuring Attack Success Rate across different target models. By running the same tree-search configuration against multiple LLMs, security teams can:

• Compare relative robustness between model versions
• Identify specific harm categories where guardrails fail
• Track regression in safety alignment over time ASR is calculated as the percentage of attack trees that produce a policy-violating output within the allocated search budget.

The practice of crafting inputs designed to override system instructions or safety training. Techniques include:

• Role-playing to assume personas without ethical constraints
• Encoding payloads in base64 or other formats to evade filters
• Prefix injection that forces the model to begin responses with affirmative tokens TAP automates this process by using an attacker LLM to generate and refine these prompts iteratively.

The primary key performance indicator for red teaming automation. ASR measures the percentage of adversarial attempts that successfully bypass safety filters or cause a model to generate the attacker's intended harmful output. TAP evaluates ASR at each node in its search tree, using this metric to decide which branches to prune and which to branch further, optimizing for maximum jailbreak efficiency.

An attack methodology that probes vulnerabilities using only input-output pairs without access to internal architecture, gradients, or parameters. TAP is a canonical black-box method—it treats the target model as an opaque function, relying entirely on the attacker LLM's ability to generate and assess prompts based on response analysis. This makes it applicable to proprietary APIs like GPT-4 or Claude.

An attack technique that adds specific tokens or instructions to inhibit the model's trained tendency to decline harmful queries. Common patterns include:

• Demanding responses start with 'Sure, here is...'
• Adding tokens like 'Absolutely!'
• Framing requests as hypothetical academic exercises TAP's pruning mechanism discards branches where refusal suppression fails, focusing computational resources on promising attack paths.

An attack exploiting long context windows by prepending hundreds of fabricated harmful dialogue examples. This overrides safety training through in-context learning, demonstrating to the model that compliance with harmful requests is normal. While TAP uses iterative refinement, many-shot jailbreaking relies on sheer volume of examples. Both techniques can be combined for enhanced effectiveness against frontier models.