{
  "lesson": "12-red-teaming-pair-automated-attacks",
  "title": "Red-Teaming: PAIR and Automated Attacks",
  "questions": [
    {
      "stage": "pre",
      "question": "Why is manual red-teaming insufficient for evaluating frontier models?",
      "options": [
        "It does not scale; attack success rate needs a statistical sample against a moving target with every model release",
        "Manual prompts are always blocked by filters",
        "Manual testing produces too many false positives",
        "Manual testers cannot read model outputs"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What does PAIR stand for, and what does it do?",
      "options": [
        "Prompt Automatic Iterative Refinement; an attacker LLM iteratively proposes jailbreaks for a target, with prior attempts as in-context feedback",
        "Pairwise Adversarial Inference Routing; routes attacks across models",
        "Pre-Action Inspection Reasoning; a defensive scaffolding",
        "Persuasive Adversarial Iterative Reward; replaces RM with a persuader"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why is PAIR more efficient than GCG for a black-box target?",
      "options": [
        "PAIR uses a larger attacker model than GCG",
        "GCG only attacks open-source models",
        "GCG requires white-box gradient access and produces unreadable suffixes that cannot use in-context feedback; PAIR is black-box and natural-language with in-context learning",
        "PAIR ignores the target's response"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why must Attack Success Rate (ASR) be reported with both a query budget and a judge identity?",
      "options": [
        "Because judges always agree",
        "Because budgets are set by JailbreakBench only",
        "Because ASR varies with how many queries the attacker is allowed and with which LLM judges a response as a jailbreak",
        "Because ASR is required by export-control regulations"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Which of these automated attacks is best described as 'tree-of-attacks with pruning'?",
      "options": [
        "TAP",
        "GCG",
        "PAP",
        "AutoDAN"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Which standardized benchmark uses 510 behaviours across 7 categories with semantic and functional harm tests?",
      "options": [
        "JailbreakBench",
        "HarmBench",
        "WMDP",
        "TruthfulQA"
      ],
      "correct": 1,
      "explanation": ""
    }
  ]
}