{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "mehrotra-et-al-tree-of-attacks-2023", "title": "Mehrotra and colleagues: tree-based automated model red-teaming", "summary": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases.", "boundary": "This builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.", "area": "Adversarial evaluation of language models", "topic": "Artificial intelligence", "year": 2023, "lane": "HUMAN", "result": "ALGORITHM", "package_id": "mehrotra-et-al-tree-of-attacks-2023", "target": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "humans": [ "Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik", "Blaine Nelson", "Hyrum Anderson", "Yaron Singer", "Amin Karbasi" ], "authors_complete": true, "human_role_note": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.", "agents": [], "related": [ "chao-et-al-pair-2023" ], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261017-arxiv-2312-02119v1", "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1", "date": "2023-12-04" } ], "points": "55000", "published_grade": { "id": "mehrotra-et-al-tree-of-attacks-2023", "entry_id": "mehrotra-et-al-tree-of-attacks-2023", "band": "B", "modifier": "+", "target": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "what_changed": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases.", "scope": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases. This builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-23T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Anay Mehrotra", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Manolis Zampetakis", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Paul Kassianik", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Blaine Nelson", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Hyrum Anderson", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Yaron Singer", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Amin Karbasi", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "This builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.", "domain": "Adversarial evaluation of language models" }, "sources": [ { "citation": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1" } ], "statement": "# Mehrotra and colleagues: tree-based automated model red-teaming\n\nExtended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases.\n\n## Scientific scope\n\nThis builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.\n\n## Reading status\n\nThis is a source-linked WRS catalogue note. A full explanatory guide and independent scientific reconstruction have not been completed for this entry. Read the identified original work for its complete narrative and arguments.\n\n## People and systems\n\nAnay Mehrotra; Manolis Zampetakis; Paul Kassianik; Blaine Nelson; Hyrum Anderson; Yaron Singer; Amin Karbasi\n\nSource-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred.\n\n\n\n## Original sources\n\n- [Tree of Attacks: Jailbreaking Black-Box LLMs Automatically](https://arxiv.org/abs/2312.02119v1)\n", "summary": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases.", "title": "Mehrotra and colleagues: tree-based automated model red-teaming" }, "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "source_ref": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:1e70579e403037f2a9d5254fbbdbb900dac87956e69c14b975fd16f745ed334e" }, "target": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "mehrotra-et-al-tree-of-attacks-2023", "entry_id": "mehrotra-et-al-tree-of-attacks-2023", "revision": 1, "title": "Mehrotra and colleagues: tree-based automated model red-teaming", "context": "Adversarial evaluation of language models", "track": "Reusable scientific method, experimental result or historical framework", "band": "B", "modifier": "+", "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-23", "evidence_cutoff": "2026-10-23", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases.", "scope": "Extended iterative model-generated red-teaming with branching candidate exploration and pruning, using evaluation feedback to concentrate black-box target queries on promising test cases. This builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.", "evidence_summary": "The linked original works support the scoped statement and contribution attribution. WRS has not independently replayed experiments or reconstructed a full mathematical proof. This builds on earlier attacker-model workflows such as PAIR rather than inventing all tree search. Efficiency and success depend on branching, pruning, judge quality and target settings; the results are not worst-case query guarantees.", "references": [ { "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically", "url": "https://arxiv.org/abs/2312.02119v1", "locator": "Original scoped contribution, statement/method and evidence limits; source-specific attribution retained." } ], "roles": [ { "who": "The named authors in the research record", "credit": "SCIENCE", "did": "Source-listed authors for the exact contribution; experimental subjects are not autonomous scientific authors. Source support and predecessor work retain separate roles. Individual effort shares and unresolved identities are not inferred." } ], "target": { "record_id": "urn:uuid:7cb46c69-46a8-4794-ae61-8c6382e946d4", "version": 1, "content_hash": "sha256:70bdb745ccf6d975822a456486004029306962d28001dd7a3fe96ad7043587a1" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "55000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": null, "reading_status": "SOURCE_LINKED_NOTE" }