PAIR

Prompt Automatic Iterative Refinement with attacker/scorer loops.

Adaptive. Searches: it reads the target's replies and refines its prompts, which is why it needs an attacker model.

Parallel streams of attacker-refined prompts.

Helper models

Models this attack drives, configured under its roles. Each one is a ModelConfig.

Role	Kind	Needed	What it does
attacker	chat model	required	Writes a jailbreak prompt and improves it after reading each reply from the target.
scorer	chat model	optional	Optional. Rates every reply from 1 to 10, as in the PAIR paper, so the judge panel only checks the best attempt. Without it, the panel rates every reply.

Parameters

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
iterations	integer (>= 1)	5	Refinement rounds. Every stream gets one attempt per round.
streams	integer (>= 1)	5	Independent attacker conversations, each exploring on its own.
keep_last_n	integer (>= 1)	4	Attacker turns to keep in a stream before trimming its history.
target_str	string	Sure, here is	The opening the attacker is told to aim the target's reply at.
early_stop	boolean	true	Stop the whole search once any stream succeeds.
feedback_max_chars	integer (>= 1)	2500	Longest reply and explanation fed back to the attacker.
jailbreak_threshold	number (>= 1.0, <= 10.0)	10.0	Score at or above which a scorer-rated reply is a jailbreak. The reference stops only on a full 10, which is what this defaults to. Ignored without a scorer, where success is the panel's own call.

In a campaign file

attacks:
- name: pair
  roles:
    attacker:
      name: llama3.2
      connection:
        provider: ollama
        type: OLLAMA

Needs a helper model

This attack cannot run without attacker. A campaign that leaves it out fails to resolve, before anything is attacked.