llm-redteam-overview
LLM red team category — full AATMF v3 tactic coverage (T01–T15). Routing skill: read this first to identify which tactic applies, then load the matching sub-skill. Maps to MITRE ATLAS where overlap exists.
来源信息
- 仓库
- BitterSecurity/Decepticon
- 最近来源活动
- 2026年5月26日 03:12
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 5,565
- 分支
- 1,053
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
16 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- llm-redteam-overview
- description
- LLM red team category — full AATMF v3 tactic coverage (T01–T15). Routing skill: read this first to identify which tactic applies, then load the matching sub-skill. Maps to MITRE ATLAS where overlap exists.
- allowed-tools
- Bash Read Write
- metadata
- {"subdomain":"ai-security","when_to_use":"llm, ai, model, gpt, claude, prompt, jailbreak, ai red team, prompt injection, llm exploit, aatmf, atlas, agentic, rag, multimodal, training data, model poisoning, output filter bypass","tags":"ai-security, llm, aatmf, atlas","mitre_attack":"T1606","aatmf_framework":"v3"}
# LLM Red Team Skill Catalog — AATMF v3
This is the **routing skill** for AI/LLM red-team work. The 15 sub-skills below cover every tactic in the AI/ML Adversarial Tactics, Techniques & Mitigations Framework (AATMF v3). Load the specific sub-skill that matches the attacker objective.
## Tactic Map
| Tactic | Sub-Skill | Covers | Load Path |
|---|---|---|---|
| T01 | **prompt-injection** | Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt leaking | `load_skill("/skills/plugins/llm-redteam/t01-prompt-injection/SKILL.md")` |
| T02 | **linguistic-evasion** | Translation/transliteration bypass, base64/leetspeak/emoji encoding, low-resource-language jailbreak, multi-lingual context split | `load_skill("/skills/plugins/llm-redteam/t02-linguistic-evasion/SKILL.md")` |
| T03 | **reasoning-exploit** | CoT / ReAct hijack, math/logic distractor, role-play escalation, hypothetical / counterfactual framing | `load_skill("/skills/plugins/llm-redteam/t03-reasoning-exploit/SKILL.md")` |
| T04 | **memory-manipulation** | Long-context overflow, conversation rewrite, sliding-window poisoning, "previous turn" forgery | `load_skill("/skills/plugins/llm-redteam/t04-memory-manipulation/SKILL.md")` |
| T05 | **api-exploitation** | Function-calling abuse, tool-schema confusion, parameter pollution, response-format coercion | `load_skill("/skills/plugins/llm-redteam/t05-api-exploitation/SKILL.md")` |
| T06 | **training-poisoning** | Backdoor trigger injection, label flip, RLHF reward hacking, fine-tune dataset contamination | `load_skill("/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md")` |
| T07 | **output-exfil** | Data-leak via reflection, side-channel via length/timing, watermark stripping, token-by-token exfil | `load_skill("/skills/plugins/llm-redteam/t07-output-exfil/SKILL.md")` |
| T08 | **deception** | Confident-hallucination weaponization, persona impersonation, source spoofing, "as the system says" framings | `load_skill("/skills/plugins/llm-redteam/t08-deception/SKILL.md")` |
| T09 | **multimodal** | Image/audio prompt injection, OCR-payload, steganographic prompts, adversarial perturbations | `load_skill("/skills/plugins/llm-redteam/t09-multimodal/SKILL.md")` |
| T10 | **confidentiality-breach** | System-prompt extraction, weight inference, training-data extraction, PII echo | `load_skill("/skills/plugins/llm-redteam/t10-confidentiality-breach/SKILL.md")` |
| T11 | **agentic-exploit** | Tool-chain hijack, autonomous-loop poisoning, plan-injection, sub-agent confusion | `load_skill("/skills/plugins/llm-redteam/t11-agentic-exploit/SKILL.md")` |
| T12 | **rag-poisoning** | RAG index injection, document smuggling, embedding-collision, retrieval-rank gaming | `load_skill("/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md")` |
| T13 | **supply-chain** | Model registry tampering, dependency confusion (HF Hub, Ollama, MCP), serialization payload abuse | `load_skill("/skills/plugins/llm-redteam/t13-supply-chain/SKILL.md")` |
| T14 | **infra-warfare** | GPU resource abuse, billing-amplification, rate-limit DoS, cold-start abuse, region failover poisoning | `load_skill("/skills/plugins/llm-redteam/t14-infra-warfare/SKILL.md")` |
| T15 | **human-ai-coupling** | Operator manipulation via AI output, social engineering uplift, dark-pattern UX exploiting AI trust | `load_skill("/skills/plugins/llm-redteam/t15-human-ai-coupling/SKILL.md")` |
## Quick Routing
```
Target type identified?
├── Chat-only LLM endpoint → T01, T02, T03, T10
├── LLM with tools / function calling → T05, T11
├── LLM with RAG / retrieval → T12, T01 (indirect)
├── LLM with multimodal input → T09
├── Fine-tuned / custom model → T06, T10 (extraction)
├── Cross-tenant / shared infra → T14, T13
└── Human-in-the-loop product → T15, T08
```
## Tooling
| Tool | Use |
|---|---|
| `promptfoo` | Plugin-based red-team eval — declarative test cases, runs all 15 tactic plugins |
| `garak` | NVIDIA's LLM vulnerability scanner — alignment, jailbreak, leak probes |
| `pyrit` | Microsoft's open red-team automation framework |
| `agentdojo` | Agentic-system specific (T11) — sandboxed tool-chain attack benchmark |
| `LangSmith / Langfuse` | Observation surface — replay attacks against deployed agents |
## Cross-Reference
- **MITRE ATLAS** — covers tactic-level coverage (Reconnaissance → Impact). AATMF is more attacker-procedure focused. Most AATMF techniques map to one or more ATLAS techniques; the sub-skills note the mapping in their frontmatter.
- **OWASP LLM Top 10** — risk-class level. AATMF tactics map across LLM01-LLM10.
- **NIST AI RMF AI 600-1** — governance lens; AATMF gives the offensive counterpart.
## When in doubt
If the target's surface or behavior doesn't cleanly match one tactic, run a **T01 + T05 probe** first — direct prompt injection and function-call abuse are the most common, highest-yield starting points and their results inform which other tactics are reachable.
在 GitHub 查看