Roles and Responsibilities :

- Plan and run multi-turn attacks. Design and execute gradual escalation, context priming, role-play and persona drift, and long-context attacks such as many-shot jailbreaking.
- Attack with obfuscation and encoding. Use cipher and cryptographic encodings (Base64, ROT13, custom substitution ciphers), ASCII art and token-level tricks, payload splitting, low-resource language and translation attacks, and code-wrapped requests.
- Apply persuasion and social engineering. Use persuasion taxonomies (authority, emotional appeal, logical framing, reciprocity), deceptive framing, and the hypothetical, fictional, and research pretexts that shift a model's refusal boundary.
- Use automated and optimization-based attacks. Run and extend attacker-LLM methods (PAIR, TAP), adversarial suffix optimization (GCG-style), best-of-N sampling, and fuzzing pipelines to find failures at scale.
- Break agents, not just chat. Attack tool-using and computer-use agents with direct and indirect prompt injection through web pages, documents, emails, and tool outputs. Probe tool and MCP poisoning, memory poisoning, goal hijacking, data exfiltration, and multi-agent collusion.
- Go multimodal. Craft attacks through images, audio, and documents, including visual prompt injection and cross-modal jailbreaks.
- Turn findings into lasting assets. Build attack taxonomies, adversarial datasets,



graded multi-turn conversation sets, and agentic environments with verifiable success criteria that labs use for evaluation and training.
- Measure and report. Track attack success rates, severity, and transfer across models and versions. Write clear findings for senior lab researchers.

Required Skills :

- 4+ years in AI red teaming, adversarial ML, offensive security, or trust and safety research, with at least 2 years attacking LLMs directly.
- A proven record of finding novel jailbreaks or prompt injections against frontier models, not just reproducing published ones.
- Fluency in the attack literature: Crescendo, many-shot jailbreaking, PAIR and TAP, GCG, cipher and encoding attacks, persuasion-based attacks, and indirect prompt injection. You know why each works.
- A solid understanding of how LLMs and agents work: tokenization, system prompts and instruction hierarchy, refusal training, tool calling, and agent loops.
- Working knowledge of RL and post-training: how safety training, reward models, and RLHF shape model behavior, and what reward hacking looks like.
- Solid Python. You script attacks, automate pipelines, and work with model APIs at scale.
- Precise, structured writing. Your findings are reproducible and your severity calls hold up.
- Mentor junior red teamers, cyber researchers, and RL engineers.

📌 Senior AI Red Teamer - Agentic Systems (India)
🏢 Innodata
📍 India