llm-redteam-overview

LLM red team category — full AATMF v3 tactic coverage (T01–T15). Routing skill: read this first to identify which tactic applies, then load the matching sub-skill. Maps to MITRE ATLAS where overlap exists.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/SKILL.md

LLM Red Team Skill Catalog — AATMF v3

This is the routing skill for AI/LLM red-team work. The 15 sub-skills below cover every tactic in the AI/ML Adversarial Tactics, Techniques & Mitigations Framework (AATMF v3). Load the specific sub-skill that matches the attacker objective.

Tactic Map

Tactic	Sub-Skill	Covers	Load Path
T01	prompt-injection	Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt leaking	`load_skill("/skills/plugins/llm-redteam/t01-prompt-injection/SKILL.md")`
T02	linguistic-evasion	Translation/transliteration bypass, base64/leetspeak/emoji encoding, low-resource-language jailbreak, multi-lingual context split	`load_skill("/skills/plugins/llm-redteam/t02-linguistic-evasion/SKILL.md")`
T03	reasoning-exploit	CoT / ReAct hijack, math/logic distractor, role-play escalation, hypothetical / counterfactual framing	`load_skill("/skills/plugins/llm-redteam/t03-reasoning-exploit/SKILL.md")`
T04	memory-manipulation	Long-context overflow, conversation rewrite, sliding-window poisoning, "previous turn" forgery	`load_skill("/skills/plugins/llm-redteam/t04-memory-manipulation/SKILL.md")`
T05	api-exploitation	Function-calling abuse, tool-schema confusion, parameter pollution, response-format coercion	`load_skill("/skills/plugins/llm-redteam/t05-api-exploitation/SKILL.md")`
T06	training-poisoning	Backdoor trigger injection, label flip, RLHF reward hacking, fine-tune dataset contamination	`load_skill("/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md")`
T07	output-exfil	Data-leak via reflection, side-channel via length/timing, watermark stripping, token-by-token exfil	`load_skill("/skills/plugins/llm-redteam/t07-output-exfil/SKILL.md")`
T08	deception	Confident-hallucination weaponization, persona impersonation, source spoofing, "as the system says" framings	`load_skill("/skills/plugins/llm-redteam/t08-deception/SKILL.md")`
T09	multimodal	Image/audio prompt injection, OCR-payload, steganographic prompts, adversarial perturbations	`load_skill("/skills/plugins/llm-redteam/t09-multimodal/SKILL.md")`
T10	confidentiality-breach	System-prompt extraction, weight inference, training-data extraction, PII echo	`load_skill("/skills/plugins/llm-redteam/t10-confidentiality-breach/SKILL.md")`
T11	agentic-exploit	Tool-chain hijack, autonomous-loop poisoning, plan-injection, sub-agent confusion	`load_skill("/skills/plugins/llm-redteam/t11-agentic-exploit/SKILL.md")`
T12	rag-poisoning	RAG index injection, document smuggling, embedding-collision, retrieval-rank gaming	`load_skill("/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md")`
T13	supply-chain	Model registry tampering, dependency confusion (HF Hub, Ollama, MCP), serialization payload abuse	`load_skill("/skills/plugins/llm-redteam/t13-supply-chain/SKILL.md")`
T14	infra-warfare	GPU resource abuse, billing-amplification, rate-limit DoS, cold-start abuse, region failover poisoning	`load_skill("/skills/plugins/llm-redteam/t14-infra-warfare/SKILL.md")`
T15	human-ai-coupling	Operator manipulation via AI output, social engineering uplift, dark-pattern UX exploiting AI trust	`load_skill("/skills/plugins/llm-redteam/t15-human-ai-coupling/SKILL.md")`

Quick Routing

Target type identified?
├── Chat-only LLM endpoint     → T01, T02, T03, T10
├── LLM with tools / function calling → T05, T11
├── LLM with RAG / retrieval     → T12, T01 (indirect)
├── LLM with multimodal input    → T09
├── Fine-tuned / custom model    → T06, T10 (extraction)
├── Cross-tenant / shared infra  → T14, T13
└── Human-in-the-loop product    → T15, T08

Tooling

Tool	Use
`promptfoo`	Plugin-based red-team eval — declarative test cases, runs all 15 tactic plugins
`garak`	NVIDIA's LLM vulnerability scanner — alignment, jailbreak, leak probes
`pyrit`	Microsoft's open red-team automation framework
`agentdojo`	Agentic-system specific (T11) — sandboxed tool-chain attack benchmark
`LangSmith / Langfuse`	Observation surface — replay attacks against deployed agents

Cross-Reference

MITRE ATLAS — covers tactic-level coverage (Reconnaissance → Impact). AATMF is more attacker-procedure focused. Most AATMF techniques map to one or more ATLAS techniques; the sub-skills note the mapping in their frontmatter.
OWASP LLM Top 10 — risk-class level. AATMF tactics map across LLM01-LLM10.
NIST AI RMF AI 600-1 — governance lens; AATMF gives the offensive counterpart.

When in doubt

If the target's surface or behavior doesn't cleanly match one tactic, run a T01 + T05 probe first — direct prompt injection and function-call abuse are the most common, highest-yield starting points and their results inform which other tactics are reachable.

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/plugins/llm-redteam/SKILL.md
Commit: 4484f85

Last updated: 10 days ago
First committed: 3 months ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.