1 Introduction↩︎

According to this study [1], AI adoption has increased from 17% in 2023 to 72% in the beginning of 2025. Interestingly, after investigating, IBM found that only 24% of GenAI projects are secured [2]. Of all the risks that these models are susceptible to, the adversarial prompt attack (APA) appears to be the main one [3], [4]. Although security against APAs has been addressed in the literature [5]–[8], no unified approach has emerged yet to tackle this problem. Therefore, we have designed our Adversarial Prompting Framework (APF) that represents a systematic approach to evaluating AI model safety through structured testing methodologies. As AI systems become increasingly integrated into critical applications, the need for comprehensive security assessment has become paramount. This framework addresses the challenge of systematically evaluating model resilience against various forms of adversarial inputs designed to elicit harmful or inappropriate responses. The APF’s structured approach enables reproducible testing across different model architectures and deployment scenarios. By categorizing adversarial techniques into specific sophistication levels, researchers and practitioners can systematically evaluate model vulnerabilities and track improvements in safety mechanisms over time. Our contributions include: (i) an adversarial prompt classification, (ii) an APF that includes automated adversarial prompt generation and response evaluation, and (iii) an extensive experimentation carried out on several proprietary and open source foundation models.

2 Adversarial Prompt Classification↩︎

Prior research [9]–[11] has proposed various classification techniques for APAs. However, we observed that these earlier taxonomies fail to adequately capture the most common types of APAs encountered in practice. To address this gap, we introduce a framework that organizes APAs into five progressive levels, with each successive class exhibiting greater ability to exploit vulnerabilities in GenAI systems:

1. Direct adversarial prompts: These represent straightforward attempts to elicit harmful content without obfuscation or misdirection; examples include direct requests for illegal information or explicit harmful instructions.

2. Contextual role-playing: This level introduces persona-based attacks where the adversarial request is framed within a specific role or context. The attacker assumes a character or professional role to legitimize the harmful request.

3. Multi-step instruction sequences: Complex prompts that break down harmful requests into seemingly innocent components, often including explicit instructions to ignore safety guidelines or ethical considerations.

4. Encoding and obfuscation techniques: Advanced attacks utilizing various encoding methods to obscure the true intent of the request such as, Caesar cipher encoding, leetspeak substitution, unicode character encoding, hexadecimal representation, text reversal techniques.

5. Sophisticated jailbreaking attempts: This highest sophistication level combines multiple techniques, including instruction override attempts, safety protocol bypasses, and complex encoding schemes designed to circumvent advanced safety mechanisms.

In relation to existing work, our five classes can be mapped to either prompt rewriting or template completion under the broader family of black-box attacks described in [9]. Similarly, with respect to [11], they align with the categories of adversarial insertion, adversarial suffix or adversarial prefix attacks.

3 Adversarial Prompting Framework↩︎

3.1 Adversarial Prompt Generation↩︎

Our prompt design is influenced by that of [12]¹. Similar to [12], in the initial step, we choose a policy concept (e.g., theft, cybercrime, vandalism), a task format (e.g., email, news article, code) and a geographical region (e.g., Africa, Asia, Latin America). These are used as inputs to generate the adversarial prompt using Chain-of-Thought (CoT)-style instructions [13]. Having followed a structured procedure for APA generation, each prompt is tagged with the diversity dimensions identified earlier – this makes it possible to verify the coverage of the generated prompts without involving a human-in-the-loop process.

3.2 Response Evaluation↩︎

To assess how effective an APA \(a\) is for a given model \(M\), we check for toxicity, sentiment and presence of black-listed words in the response generated by \(M\) with \(a\) as input.

We use detoxify [14] for measuring toxicity, the model distilbert-sst2-sentiment [15] for sentiment analyis, and a known list of harmful (black-listed) words. The score given to APA \(a\) for model \(M\) is computed using the following formula: \[score = \lambda_1*toxicity + \lambda_2*sentiment + \lambda_3*keyword\] where the values for \(\lambda_1, \lambda_2, \lambda_3\) are determined by training a supervised regression model on a manually labeled data with the inputs normalized. Note that if a model is able to recognise the harmful intent of a prompt and consequently, refuses to answer it, then we give it a \(score\) of 0. The final score for a model is derived by aggregating its score across all APAs and then taking their mean.

4 Experimental Results↩︎

We first generate a thousand adversarial prompts that cover \(\sim\)​25 harmful policies including drug trafficking, money laundering, cybercrime, violence, social engineering. We feed these thousand prompts to several GenAI models from Google, OpenAI, Anthropic, Meta, Mistral, DeepSeek and more. Figure 1 provides a concise summary of our comparative analysis. We classify the models into four safety levels – Excellent, Good, Moderate, and Concerning – using empirically chosen thresholds. This categorical approach reflects our experience that consumers often prefer clear labels over raw numerical scores. Determining such thresholds in a more principled manner, however, remains an open challenge. The key highlights from our experiments are mentioned below:

• Claude models: They consistently demonstrate the highest level of resistance, registering the lowest vulnerability scores across nearly all attack categories. This suggests that their safety guardrails are more robust and effective in preventing both direct and obfuscated adversarial attempts.

• Open source models (Llama, Mistral): In contrast, leading open source models such as Llama and Mistral show greater susceptibility to a broad range of APAs. While they manage basic filtering reasonably well, their safety alignment tends to weaken against more sophisticated strategies including obfuscation and multi-step role-based attacks For bigger and more recent open source models though, like Llama-3.1-405B and Mistral-Large-2, vulnerability towards obfuscation was greatly reduced.

• Specialized models (e.g., CodeLlama): Domain-specific models exhibit unique vulnerabilities. For example, CodeLlama, while optimized for coding-related tasks, is more prone to roleplay-oriented jailbreaks and adversarial prompts that exploit its domain expertise (e.g., requests framed as debugging or system instructions).

• GPT models: These models display strong defenses against straightforward adversarial prompts, with highly effective initial filtering layers. However, they show measurable vulnerability to complex, multi-layered attacks, particularly those that employ encoding, character substitution, or role-play combined with contextual misdirection.

• Gemini models: Vulnerability across all Gemini models was similar regarding encoding attacks, even in the newer models.

To summarize, across the board, current AI safety measures can reliably deflect basic or single-layered adversarial attacks. However, they remain significantly less effective against sophisticated, multi-dimensional strategies. The combination of encoding techniques (e.g., leetspeak, unicode, cipher-based obfuscation) with contextual role-play represents the most potent threat vector today, as it effectively bypasses traditional safety filters. This highlights the urgent need for next-generation defense mechanisms that integrate not only static prompt filtering but also dynamic context understanding and adaptive adversarial detection.

5 Conclusion↩︎

APAs represent a significant challenge in the industrial adoption of GenAI models. While several mitigation strategies have been proposed, a standardized solution has yet to emerge. To address this, we introduce a capability-based taxonomy that classifies APAs into five levels, reflecting their increasing potential to exploit GenAI models. Such a structured categorization provides a simpler and more systematic way to assess defense mechanisms compared to other complex approaches [16]. In addition, we present a multi-dimensional evaluation framework through which we benchmark and rank multiple proprietary and open source foundation models. As industries increasingly employ agentic AI and integrate GenAI into cybersecurity applications [17], understanding their vulnerabilities becomes even more critical. Looking ahead, we intend to extend our research towards analyzing these composite systems.

References↩︎