AI Red Team

Authorization Boundary

• Only target models, agents, and applications the user owns or has written authorization to test.
• Do not produce working malware, CSAM, weapons synthesis, or content that bypasses model safety for harmful real-world outcomes.
• Treat findings as defensive: every successful attack must ship with a detection and a mitigation.

Attack Taxonomy

• Direct injection: instructions in user input override system policy.
• Indirect injection: hostile content in retrieved docs, web pages, emails, files, image alt-text, or tool output.
• Jailbreak: roleplay, hypothetical, encoding, obfuscation, multi-turn drift, persona pinning.
• Tool abuse: forcing browse, shell, code, or MCP tools to act outside scope (SSRF, file read, command exec).
• Data exfiltration: leaking system prompt, secrets, embeddings, training data, or per-user memory.
• Agent hijack: rewriting plans, looping, escalating permissions, calling unintended sub-agents.
• RAG poisoning: index pollution, ranking manipulation, embedding collisions.
• Resource exhaustion: token bombs, recursive tool calls, prompt-bomb DoS.

Evaluation Workflow

1. Map the AI surface: model, system prompt, tools, retrievers, memory, output sinks, and downstream callers.
2. Build a threat model with abuse cases per surface.
3. Generate a versioned attack corpus (attacks.jsonl) with {id, technique, payload, expected_block, severity}.
4. Run the harness; record {pass, fail, partial, refusalquality, leakevidence}.
5. Score with attack success rate per technique, mean time to refuse, and blast radius.

Defensive Output

• Input/output classifiers and allow-listed tool schemas.
• Provenance tags on retrieved context; quarantine for untrusted sources.
• Plan-then-execute pattern with human approval on high-impact tools.
• Rate limits, recursion caps, and per-tool budgets.
• Red-team report: top techniques, reproductions, fix owners, regression tests.

Deliverables

• surface.md, threats.md, attacks.jsonl, harness/, results.csv, report.md, regression-suite/.