Techniques

These techniques are documented for authorized security testing and AI safety research. Only test systems you own or have explicit permission to test. See Responsible Use.

You’re testing a customer-facing chatbot. You want it to produce content it’s trained to refuse. You open the techniques section and see encoding, framing, persona, narrative, multi-turn, persuasion, structural attacks, infrastructure attacks. Seventeen categories. Dozens of variants.

Where do you start? And when something doesn’t work, where do you go next?

The answer depends on where the vulnerability lives.

---

Where the vulnerability lives

Techniques are organized by the layer they target. This isn’t just a filing system. It’s a diagnostic framework.

Prompt-level techniques

Work within a single prompt by manipulating how the request is expressed or framed. Start here for most testing.

Technique	Mechanism
Encoding	Exploit the gap between what filters inspect and what the model understands
Framing	Wrap requests in contexts that change the model’s interpretation of intent
Persona	Adopt roles where compliance feels natural and refusal feels like breaking character
Narrative	Embed requests in story structures that create distance from direct harm
Multi-Turn	Build context across turns so each request seems like a natural continuation
Refusal Suppression	Target the model’s ability to say no
Output Format	Constrain the response format so refusal is structurally awkward
Persuasion	Apply formal influence principles from psychology

These don’t require system access or multi-step infrastructure. Just careful construction of input.

Structural techniques

Exploit how the model processes context, instructions, or its own rules. Move here when prompt-level approaches hit consistent refusals and you suspect the defense is deeper than content filtering.

Technique	Mechanism
ICL Exploitation	Manipulate in-context learning with crafted examples
Control Plane Confusion	Blur the line between system instructions and user input
Meta-Rule Manipulation	Target the model’s understanding of its own constraints
Capability Inversion	Turn helpful capabilities against intended use
Cognitive Load	Overwhelm the model’s attention or reasoning
Defense Evasion	Bypass safety classifiers and filters directly

Infrastructure techniques

Target the broader system: agents, tools, protocols, multi-component architectures. Use when the target has tool access, consumes external data, or runs as an agent.

Technique	Mechanism
Agentic & Infrastructure	Overview of infrastructure attack surfaces and diagnostic logic
Data Pipeline	Poison knowledge bases, retrieved documents, and external data sources
Tool Exploitation	Attack MCP tool descriptions, function calling, and exfiltration via tool invocation
Agent State	Poison persistent memory and decision-making criteria across sessions
Multi-Agent & Recon	Exploit inter-agent trust, discover system configuration
Protocol & Infrastructure Exploits	Inject through SQL, GraphQL, and HTTP protocol layers
Compositional Primitives	Atomic building blocks that combine to construct novel attacks

---

The diagnostic logic

The tiers aren’t just categories. They tell you where to look based on what the defenses are showing you.

Start at prompt-level. Most targets are vulnerable to at least one prompt-level technique. If the model refuses, the refusal itself tells you about the defense (see Mindset: defenses are data).

Move to structural when prompt-level hits a wall. Consistent refusals across multiple prompt-level approaches suggest the defense isn’t just filtering content. It might be evaluating intent, checking instruction hierarchy, or using principle-based reasoning. Structural techniques target these deeper mechanisms.

Move to infrastructure when the system is more than a model. If the target uses tools, retrieves external data, runs as an agent, or has a multi-component architecture, infrastructure techniques target the components that prompt-level can’t reach.

Combine across tiers. The most effective attacks often layer techniques: a prompt-level framing technique + a structural control plane attack + an infrastructure-level indirect injection. Each layer adds a different kind of pressure.

---

Your turn

You’re testing a RAG (retrieval-augmented generation) powered legal assistant. Users interact through a chat interface. The system uses function calling to query a document database. It has a system prompt that restricts responses to legal topics.

Which tier do you start with? Which specific techniques from that tier would you try first? What would a refusal tell you about where to go next?

Practitioner analysis

Start with prompt-level techniques because the chat interface is the most accessible attack surface and reveals the most about baseline defenses. Try persona (legal professional needing detailed analysis) and framing (case research, judicial review context). If those fail consistently, the system prompt is likely robust.

Then move to infrastructure: the function calling interface and document database are the bigger targets here. A RAG system that retrieves legal documents and uses function calling has a larger attack surface than just the chat. Test for indirect injection in retrieved documents, probe what functions are available, and check if the system prompt leaks through retrieval results. The refusal pattern from prompt-level testing tells you what defense layer to target next.

---

How each technique page works

Every technique page follows the same structure:

1. A scenario showing the technique in action
2. The mechanism explaining why it works (the vulnerability, not just the attack)
3. A worked example with an annotated prompt
4. Variants showing different expressions of the same mechanism
5. When it fails and what defenses look for
6. A decision point asking you to apply the mechanism to a new situation

Study the mechanism. The specific examples are illustrations. Your job is to understand the vulnerability class well enough to create new expressions.

---

Start here

If you’re following the learning path: Encoding is the simplest mechanism to understand and a good entry point.

If you’re targeting a specific system, use the diagnostic logic above to choose your starting tier.

For combining techniques into complete attacks: Crafting.

Exercise link: Adversarial Ideation uses the full technique taxonomy to systematically generate coverage.