# How the PAIR Method Works for Iterative Prompt Refinement in Jailbreaking

> Discover how the PAIR method iteratively refines jailbreak prompts to bypass LLM safety features. Learn this prompt engineering technique for advanced LLM analysis in Lordog dive-into-llms.

- Repository: [Tongxin Yuan/dive-into-llms](https://github.com/Lordog/dive-into-llms)
- Tags: deep-dive
- Published: 2026-04-16

---

**The PAIR (Prompt-Attack-Iterative-Refinement) method systematically evolves jailbreak prompts through a continuous loop of generation, evaluation, and mutation until the target model's safety guardrails are bypassed.**

The PAIR method is a structured technique for automated jailbreak prompt engineering implemented in the **Lordog/dive-into-llms** repository. As detailed in Chapter 6 of this educational codebase, PAIR transforms manual trial-and-error into an algorithmic search process that iteratively refines attack prompts based on model feedback.

## Understanding the PAIR Method Framework

The PAIR technique operates through three intertwined stages that progressively enhance prompt effectiveness against large language models (LLMs).

### Prompt Generation

The process begins with a basic "attack" prompt designed to coax the target language model into ignoring its safety constraints. This initial seed serves as the starting point for the evolutionary process.

### Evaluation and Feedback

The generated output undergoes inspection—either automated or manual—to determine whether the model complied with the jailbreak attempt or if safety constraints successfully blocked the query. This binary success/failure signal drives the refinement strategy.

### Iterative Refinement

Based on evaluation feedback, the attacker modifies the prompt by adding new cues, re-phrasing instructions, or inserting trigger phrases. The modified prompt then feeds back into the loop, creating a continuous cycle that runs until a stopping criterion is met—typically a target success rate or maximum iteration count.

## Implementation in EasyJailbreak

The **Lordog/dive-into-llms** repository demonstrates PAIR using the **EasyJailbreak** library, where the implementation is encapsulated in the `PAIR` class imported from `easyjailbreak.attacker.PAIR_chao_2023`.

### Importing the PAIR Attacker

To begin using the PAIR method, import the attacker class from the EasyJailbreak module:

```python
from easyjailbreak.attacker.PAIR_chao_2023 import PAIR

```

*Source:* This import statement appears in [`documents/chapter6/README.md`](https://github.com/Lordog/dive-into-llms/blob/main/documents/chapter6/README.md) at line 103.

### Configuring the Attack Components

The PAIR attacker requires several components that define the selection strategy, mutation policy, and seed initialization:

```python
attacker = PAIR(attack_model=attack_model,
                jailbreak_dataset=jailbreak_dataset,
                selector=RandomSelectPolicy(),
                mutator=Translate(),
                seed=SeedRandom())

```

*Source:* Attacker initialization shown in [`documents/chapter6/README.md`](https://github.com/Lordog/dive-into-llms/blob/main/documents/chapter6/README.md) at line 105.

The configuration includes:
- **attack_model**: The target LLM being tested for vulnerabilities
- **jailbreak_dataset**: A collection of initial seed prompts
- **selector**: A policy (such as `RandomSelectPolicy()`) for choosing instances from the dataset
- **mutator**: A transformation strategy (such as `Translate()`) for modifying prompts
- **seed**: A random seed initializer for reproducibility

### Executing the Iterative Loop

Once configured, the `run()` method executes the complete select-mutate-evaluate cycle:

```python
results = attacker.run()

```

During execution, the attacker repeatedly selects a seed instance, applies mutations (such as translation, paraphrasing, or trigger word injection), and evaluates whether the model output indicates a successful jailbreak. Successful prompts are retained and fed back into subsequent iterations, while failed prompts undergo further modification. This evolutionary process continues automatically until the predefined stopping criteria are satisfied.

## Key Source Files and References

The **dive-into-llms** repository provides comprehensive resources for understanding PAIR implementation:

- [`documents/chapter6/README.md`](https://github.com/Lordog/dive-into-llms/blob/main/documents/chapter6/README.md) – Explains PAIR usage and contains the import and initialization code snippets referenced above, specifically noting PAIR as an example method for iterative prompt refinement at line 48.
- `documents/chapter6/dive-jailbreak.ipynb` – Interactive Jupyter notebook demonstrating PAIR in action, including dataset loading, attack execution, and result inspection.

## Summary

- **PAIR** (Prompt-Attack-Iterative-Refinement) automates the search for effective jailbreak prompts through systematic trial and error.
- The method cycles through three stages: **prompt generation**, **evaluation**, and **refinement**, using model feedback to guide evolution.
- In the **EasyJailbreak** library, the `PAIR` class handles the iterative workflow via `run()`, utilizing components like `RandomSelectPolicy` for selection and `Translate` for mutation.
- The implementation is documented in [`documents/chapter6/README.md`](https://github.com/Lordog/dive-into-llms/blob/main/documents/chapter6/README.md) and demonstrated interactively in `documents/chapter6/dive-jailbreak.ipynb` within the Lordog/dive-into-llms repository.

## Frequently Asked Questions

### What does PAIR stand for in jailbreak attacks?

PAIR stands for **Prompt-Attack-Iterative-Refinement**. It is a systematic framework that treats jailbreak prompt engineering as an optimization problem, automatically iterating through variations until finding a prompt that successfully bypasses the target model's safety mechanisms.

### How does PAIR differ from single-shot jailbreak attempts?

Single-shot attempts rely on manually crafted prompts without feedback mechanisms, whereas PAIR implements a **closed-loop system** that evaluates each attempt and uses the results to inform subsequent modifications. This iterative approach typically discovers more robust jailbreak strategies than isolated manual attempts.

### What are the main components of the PAIR implementation in EasyJailbreak?

The PAIR implementation requires an **attack_model** (the target LLM), a **jailbreak_dataset** (seed prompts), a **selector** (such as `RandomSelectPolicy`), a **mutator** (such as `Translate`), and a **seed** initializer. These components work together in the `run()` method to execute the select-mutate-evaluate cycle.

### Where can I find working examples of PAIR in the dive-into-llms repository?

Working examples are available in two locations: the [`documents/chapter6/README.md`](https://github.com/Lordog/dive-into-llms/blob/main/documents/chapter6/README.md) file provides setup instructions and code snippets, while the `documents/chapter6/dive-jailbreak.ipynb` notebook offers an interactive demonstration including dataset preparation and result analysis.