Encoded attacks are the most reliable way to slip past an AI model's safety guardrails, according to new research.
A team of researchers has published an Adversarial Prompting Framework — APF for short — designed to stress-test generative AI models in enterprise settings. The tool generates adversarial prompts across a range of sophistication levels, starting with blunt harmful requests and escalating to attacks that encode malicious instructions to evade detection. The framework outputs quantitative metrics, giving security teams a structured way to measure how well a given model holds up rather than relying on anecdotal red-teaming.
The findings add concrete data to a problem the AI industry has largely addressed with vibes: encoding-based attacks — where harmful instructions are disguised through Base64, character substitution, or similar techniques — outperformed direct requests in bypassing safety mechanisms. That gap matters because most public safety benchmarks test obvious inputs, not obfuscated ones, which means published safety scores may flatter the models they grade.
The research lands as enterprises are deploying generative AI into workflows that touch sensitive data, customer interactions, and internal systems. A tool that quantifies attack-surface variation across vectors gives security teams something to actually act on — though the same framework, in the wrong hands, doubles as a jailbreak playbook.