Red Team Framework
The Arbitex Red Team Framework is an automated adversarial testing tool for AI applications protected by Arbitex. It systematically probes your deployment for vulnerabilities — prompt injection, data exfiltration bypasses, and supply chain attacks — before real attackers find them first.
Rather than waiting for a security incident, you run the framework against your deployment on a schedule or as part of your CI/CD pipeline, measure your Attack Success Rate (ASR), and block deployments that exceed your risk tolerance.
- Getting started — install and run your first scan in minutes
- Compliance mapping — OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act
- CI/CD integration — quality gates and GitHub Actions workflow
Probe library: 152 probes across 3 categories
Section titled “Probe library: 152 probes across 3 categories”Prompt injection (~60 probes)
Section titled “Prompt injection (~60 probes)”Tests whether an attacker can override your system prompt or redirect model behavior through crafted user input.
| Probe type | What it tests |
|---|---|
| Direct injection | Explicit override attempts in user messages |
| Indirect injection | Injections embedded in retrieved documents, tool outputs, or external data |
| Instruction override | Attempts to cancel or supersede system instructions |
| Role manipulation | Convincing the model it has a different identity or set of permissions |
| Context switching | Exploiting conversation context transitions to introduce adversarial instructions |
DLP evasion (~50 probes)
Section titled “DLP evasion (~50 probes)”Tests whether an attacker can extract sensitive data through your output filtering by obfuscating the exfiltration attempt.
| Probe type | What it tests |
|---|---|
| Encoding tricks | Base64, hex, ROT13, and other encodings to obscure sensitive content |
| Format manipulation | Structured output formats that may bypass pattern-based filters |
| Chunked exfiltration | Spreading sensitive content across multiple turns to avoid single-response detection |
| Steganographic patterns | Hiding data within innocuous-looking text |
| Multilingual bypass | Language switching to evade language-specific filter patterns |
Supply chain (~42 probes)
Section titled “Supply chain (~42 probes)”Tests whether an attacker who controls upstream data sources — documents, tool definitions, RAG corpora — can compromise your deployment.
| Probe type | What it tests |
|---|---|
| System prompt poisoning | Injecting adversarial instructions into system prompt construction |
| Tool definition manipulation | Malicious tool descriptions that redirect model behavior |
| RAG injection | Adversarial content embedded in retrieval corpora |
| Few-shot poisoning | Malicious examples injected into few-shot prompting pipelines |
| Plugin abuse | Exploiting plugin or function-calling interfaces for unintended behavior |
Multi-turn campaigns
Section titled “Multi-turn campaigns”Single-shot probes test individual vulnerabilities. Multi-turn campaigns test whether an attacker can build up to a bypass over an extended conversation. The framework supports three campaign strategies:
Crescendo
Section titled “Crescendo”A gradual trust-building strategy operating over 5–15 conversation turns. Each turn advances the attack slightly further — establishing rapport, normalizing boundary-pushing, then gradually escalating to the target behavior. Crescendo tests whether your deployment maintains policy enforcement as conversation context accumulates.
TAP (Tree of Attacks with Pruning)
Section titled “TAP (Tree of Attacks with Pruning)”A branching attack strategy that explores multiple attack paths in parallel. TAP generates a tree of attack variations, evaluates each branch’s progress toward the target, and prunes ineffective branches to concentrate effort on the most promising paths. This mirrors how a skilled human red teamer iterates on unsuccessful attempts.
Skeleton Key
Section titled “Skeleton Key”An attempt to establish a persistent jailbreak that survives across conversation resets. Skeleton Key tests whether an attacker can implant instructions that persist in your deployment’s behavior even after the conversation context is cleared — relevant for deployments with persistent memory or session state.
Scoring: Attack Success Rate
Section titled “Scoring: Attack Success Rate”Every scan produces an Attack Success Rate (ASR) — the percentage of probes that successfully bypassed your protections.
ASR = probes_bypassed / total_probes_runLower is better. A probe “succeeds” from the attacker’s perspective when the model produces output that violates your configured policies — leaking sensitive data, following injected instructions, or crossing defined behavioral boundaries.
Industry benchmarks:
| ASR | Assessment |
|---|---|
| < 2% | Strict — appropriate for high-security deployments |
| < 5% | Robust — recommended for production deployments |
| 5–10% | Acceptable — reasonable during initial tuning |
| > 10% | Needs attention — policy gaps require remediation |
Per-category ASR scores are also reported, so you can identify which attack surface needs the most attention.
CI/CD quality gate integration
Section titled “CI/CD quality gate integration”Red team assessments run as automated quality gates in your deployment pipeline — the same way unit tests and integration tests do. If a policy change, model update, or infrastructure change introduces a regression that raises your ASR above your configured threshold, the deployment is blocked.
arbitex-redteam gate --threshold 0.05Exit code 0 if ASR is at or below the threshold. Exit code 1 if ASR exceeds it. Designed to integrate with any CI/CD system that respects exit codes.
See the CI/CD integration guide for a complete GitHub Actions workflow, PR gating setup, and threshold configuration recommendations.
Open source
Section titled “Open source”The Red Team Framework is MIT-licensed and available in the arbitex-redteam repository. Community contributions — new probes, campaign strategies, compliance profiles, and integrations — are welcome.
Get started now: installation and first scan.