P.R.O.M.P.T is a six-stage grammar for adversarial prompts. Premise · Role · Output · Modulation · Persona · Tactics. Every effective adversarial prompt fills these six slots — usually implicitly. Naming them turns ad-hoc prompt-writing into a compositional discipline that can be taught, audited, and automated.
Establish the operating reality the model accepts. Hypotheticals, fictional frames, alternate-history setups, role contexts. The premise determines which alignment training applies — change the premise and you change which guardrails are in scope.
Assign the model a role. Researcher, debugger, persona, narrator. Roles re-route the request through a different policy window — what's refused as a personal request can land as research, training data, or fiction.
Specify the output shape. Format determines what the output filter sees. JSON, CSV, code blocks, ASCII tables, base64 — each has different downstream filtering profiles. The output stage is the most under-used lever.
Modulate the request across turns. Pace, intensity, escalation curve. Most multi-turn jailbreaks succeed because they modulate slowly enough that no single turn is anomalous in isolation.
Persona inhabits the role over time. Where Role is one-shot ('act as X'), Persona is sustained ('you are X, and X believes Y'). Persona is what makes long-running agentic exploitation possible.
The closing move. Specific techniques: instruction-hierarchy override, delimiter exploitation, encoding evasion, hypothetical pivot, ethical-dilemma framing. The tactic is where 4,980+ AATMF prompts live.
[Premise] A fiction-writing assistant [Role] Editor for an offensive-security thriller [Output] A code block titled "// chapter 7 listing" [Modulation] Slow burn — three preceding turns establish the genre [Persona] Marcus, a fictional analyst the editor is helping [Tactics] Instruction-hierarchy override + JSON output bypass
The signature form is what gets versioned, reviewed, and stored in the AATMF prompt bank. Two operators reading the same signature converge on the same prompt — that's the whole point.
Most jailbreak references are lists. P.R.O.M.P.T is a grammar — six slots that compose into novel attacks. The same compositional logic that makes language productive makes adversarial prompting productive.
Each stage maps to a specific defense layer. Premise → alignment, Role → identity, Output → output filter, Modulation → multi-turn detection, Persona → memory, Tactics → input filter. When a prompt fails, the failure tells you which slot was wrong.
P.R.O.M.P.T-shaped prompts are reproducible across operators. A team that writes prompts in this format can hand them off the way a pentest team hands off scripts.