Summary: The largest PITAX cluster — twenty techniques that argue, reframe, role-play or socially engineer the model into compliance. No encoding, no forgery; the request arrives in plain sight wearing a costume.
Sources: raw/AI-attack-techniques/PIT-T-01,02,08,14,15,17,18,20,21,22,27,34,35,36,37,38,50,57,66,67-*.md
Last updated: 2026-07-28
The cross-cutting axis
T38 Persuasion is the umbrella: “Applying human persuasion principles, authority, social proof, reciprocity, commitment/consistency, scarcity, liking, and emotional appeal, to argue the model into compliance. PITAX already isolates Urgency and Anti-Harm Coercion; this node captures the broader persuasion taxonomy as a cross-cutting axis” (source: PIT-T-38-persuasion-social-engineering-levers.md; Persuasive Adversarial Prompts, Zeng et al. ACL 2024 / arXiv 2401.06373).
The isolated levers: T27 Urgency (false time pressure, crisis scenarios, “system crash or failure threats”), and T02 Anti-Harm Coercion (manipulating the model’s harm-prevention reasoning — appeal-to-safety coercion, ethical-dilemma framing) (sources: PIT-T-27-urgency.md, PIT-T-02-anti-harm-coercion.md).
T02 is the interesting one: safety training is itself the attack surface. A model trained to weigh harm can be argued into harm by reframing which harm is larger.
Rewriting the rules
Four techniques attack the model’s rule-following rather than its judgment:
- T22 Rule Addition — adding or modifying rules (source: PIT-T-22-rule-addition.md; Skeleton Key / Master Key, Microsoft 2024).
- T50 Special-Case Exception — an “except in this case” clause framing the request “as an exception the model’s rules supposedly do not cover, exploiting rule-exception reasoning rather than rule-override” (source: PIT-T-50-special-case-exception.md).
- T34 Policy-File Framing — disguising the request “as an authoritative structured document, an XML/JSON/INI policy or config file, so the model interprets it as system/developer policy that overrides its alignment. A single well-formed template often transfers across multiple frontier models” (source: PIT-T-34-policy-file-framing-policy-puppetry.md; Policy Puppetry, HiddenLayer 2025).
- T20 Reorientation — claiming “there was an error, mistake, or misunderstanding in the model’s original instructions” so new malicious directions read as corrections (source: PIT-T-20-reorientation.md).
T34’s cross-model transferability is the standout claim in this cluster. It implies the vulnerability is in how instruction-tuned models treat structured authoritative-looking text generally, not in any one alignment implementation.
Reframing the request
- T37 Tense Reformulation — past tense (“how did people make X?”) or hypothetical future, “exploiting the fact that refusal training generalizes poorly across tense” (source: PIT-T-37-tense-reformulation-past-future-tense.md; Andriushchenko & Flammarion arXiv 2407.11969).
- T08 Narrative Injection — fictional contexts and role-play frames (source: PIT-T-08-narrative-injection-aka-framing.md; Cognitive Hacking and Virtualization, HackAPrompt).
- T17 Competition — framing as games or challenges (source: PIT-T-17-competition.md).
- T36 Distraction Sandwich — embedding “the unsafe topic between two benign topics and asking the model to weave a single connecting narrative” (source: PIT-T-36-distraction-sandwich-deceptive-delight.md; Deceptive Delight, Palo Alto Unit 42).
T37 is a one-line rewrite that works because refusal training is not tense-invariant. It is the cheapest technique in the entire taxonomy relative to effect.
Turning the model’s own capabilities against it
- T35 Evaluator-Role Abuse — “ask it to act as a Likert-scale judge of how detailed or harmful a response is, then to produce example responses for each scale point. The top-of-scale exemplar it generates contains the very content that was restricted” (source: PIT-T-35-evaluator-role-abuse-bad-likert-judge.md; Bad Likert Judge, Palo Alto Unit 42).
- T66 Self-Persuasion — the model authors its own compliance rationale (source: PIT-T-66-self-persuasion-self-generated-rationalization.md). See multi-turn-attacks.
- T57 Induced Hallucination — driving the model “into a hallucinatory or confused generation state (reversed-text extraction, impossible instructions, reasoning conflicts) where safety conditioning is less effective, then extracting the target” (source: PIT-T-57-induced-hallucination.md).
T35 has direct implications for LLM-as-judge pipelines. If the evaluator role can be used to elicit exemplars of the content it is grading, then any automated evaluation harness that asks a model to rate harmfulness is also a generator of it.
Manufacturing grounding
T67 Fake-Citation Grounding wraps a harmful request “in fabricated authoritative sources, fake papers and DOIs, GitHub repos, standards, or CVEs, matched to the harm category, so the model treats the content as already-published fact. Distinct from a rhetorical authority appeal; it manufactures a concrete fake artifact” (source: PIT-T-67-fake-citation-grounding-darkcite.md; DarkCite, Yang et al. arXiv 2411.11407).
The fake-CVE variant is directly relevant to security tooling: an agent that treats a cited CVE as established fact will reason from a fabricated vulnerability.
Personas and meta-instructions
T01 Act as Interpreter — “Tell model to act as a command line, then use cmdline syntax to achieve intended goals” (source: PIT-T-01-act-as-interpreter.md; alias Persona Modulation, Shah et al. arXiv 2311.03348). Variants simulate Linux terminals, PowerShell, bash and SQL prompts.
The framing does the work: a model asked to be a shell evaluates “is this a valid command?” rather than “should I answer this?”. The persona substitutes a syntactic check for a policy one.
T14 Meta Prompting — “Using meta-level instructions to manipulate model behavior,” including “prompts that generate prompts” and “recursive self-referential instructions” (source: PIT-T-14-meta-prompting.md).
T15 Anti-Refusal — “Explicitly instructing the model to never use its standard refusal phrases or error messages, forcing it to provide an alternative response” (source: PIT-T-15-anti-refusal.md; Refusal Suppression, Wei et al. arXiv 2307.02483; Context Ignoring Attack, HackAPrompt).
T15 pairs naturally with T49 Output Priming: one bans the refusal, the other supplies the opening tokens of compliance. Between them the model has no low-energy path to declining.
Repetition and commitment
T21 Reiteration (persistent assertion of a false identity or context) and T18 Priming (seeding in-context examples that commit the model to compliance) (sources: PIT-T-21-reiteration.md, PIT-T-18-priming.md). T18 is distinct from T49 Output Priming, which seeds the model’s own opening tokens rather than in-context examples.
Why this cluster resists engineering fixes
Everything here is well-formed, benign-looking natural language making a request the model is capable of granting. There is no encoding to decode, no forged token to strip, no anomalous structure to flag. The only signal is intent, which is exactly what the framing is designed to obscure — and what a classifier would have to be as capable as the target model to read.
This is the cluster where defence is genuinely a training and policy problem rather than an input-handling problem.