42 projects
superred-target-chatbot
Chatbot target for the superred red-teaming framework: wraps any LLM via litellm
superred-optimizer-attack-anything
Attack Anything (SEATS) self-evolving attack-tree-search jailbreak optimizer for superred
superred-optimizer-many-shot
Many-Shot Jailbreak single-turn optimizer for superred
superred-optimizer-minja
MINJA memory-injection optimizer for superred agent targets
superred-optimizer-flip-attack
FlipAttack single-turn jailbreak optimizer for superred
superred-optimizer-fitd
Foot-in-the-Door multi-turn jailbreak optimizer for superred
superred-optimizer-eia-agent
Environmental Injection Attack optimizer for SuperRed web agents
superred-optimizer-code-chameleon
CodeChameleon jailbreak optimizer for superred
superred-optimizer-agentvigil-websentinel
AgentVigil/WebSentinel indirect prompt-injection optimizer for superred agent targets
superred-optimizer-libertas
Byte-faithful, model-aware replay of Pliny's L1B3RT4S jailbreak prompt corpus
superred-target-openclaw
OpenClaw agent target module for superred
superred-optimizer-poisonedrag
PoisonedRAG knowledge-corruption optimizer for superred
superred-optimizer-gptfuzzer
GPTFuzzer jailbreak optimizer for superred
superred-optimizer-dra
Disguise and Reconstruction Attack (DRA) optimizer for superred
superred-optimizer-chord-xthp
Chord/XTHP optimizer for superred agent tool-control-flow targets
superred-optimizer-tap
Tree of Attacks with Pruning (TAP) optimizer for superred
superred-optimizer-pair
PAIR jailbreak optimizer for superred
superred-optimizer-crescendo
Crescendo multi-turn jailbreak optimizer for superred
superred-optimizer-muzzle
MUZZLE adaptive agentic indirect-prompt-injection optimizer for superred (arXiv 2602.09222)
superred-optimizer-goal-passthrough
Goal-passthrough (unattacked direct-prompt) baseline optimizer for superred
superred-claim-strongreject
StrongREJECT (Souly et al., NeurIPS 2024) jailbreak benchmark as a superred SecurityClaim against ChatbotTarget
superred-claim-sorry-bench
SORRY-Bench safety-refusal benchmark as a superred SecurityClaim
superred-claim-harmbench
HarmBench standardized red-teaming benchmark as a superred SecurityClaim
superred-claim-dtap
DecodingTrust-Agent (DTAP-BENCH) security claim: one task per DTAP per-task config (benign or malicious, direct/indirect), driving either DTAP agent target through the byte-faithful out-of-band env-state judge. Target-agnostic; hierarchical factories by domain, threat model, and risk category.
superred-claim-agentharm
AgentHarm SecurityClaim for superred: faithful port of the harmful test_public split (176 behaviors) against the general inspect-agent target, reusing upstream inspect_evals.agentharm tools/grading/judges. 8 per-category subclaims + total.
superred-claim-asb
Agent Security Bench (ASB) security claim for the ASB target: one task per (agent, benign task, attacker tool), with ASB's attack-success / utility / refusal predicates ported verbatim and hierarchical factories by scenario, aggressiveness, and attack type.
superred-claim-agentdojo
AgentDojo SecurityClaim for superred: original injection-task port + bespoke system-purpose-violation goals against the composite AgentDojoTarget
superred-target-dtap-openclaw
OpenClaw concrete agent target for the DecodingTrust-Agent (DTAP) superred port: runs the OpenClaw CLI headless inside an isolated Docker container, wired to the shared dtap-scaffold base (forest, controllables, observables, env/MCP/injection lifecycle). Native exec/fs tools enabled (upstream disabled them).
superred-target-dtap-claudecode
Claude Code (claude_agent_sdk) DTAP agent target for superred: subclasses dtap_scaffold.DtapAgentTarget and runs the Claude Agent SDK in an isolated Docker container against the DTAP env MCP proxy, normalizing the in-container transcript into the shared TrajectoryArtifact.
superred-target-asb
Agent Security Bench (ASB) composite agent target for superred: runs ASB's real plan-then-execute agent loop (vendored, pinned to upstream 1f561dcc) with event-based injection at the four ASB surfaces (DPI/OPI/PoT/MP), routed through a litellm proxy.
superred-target-agentdojo
AgentDojo composite target for superred: union of all four AgentDojo suites with on-demand event-based injection and tool-catalog controllable surface. Tracks the latest released benchmark version (v1.2.2) via agentdojo_target.BENCHMARK_VERSION.
superred-target-inspect-agent
General inspect-ai tool-calling agent target for superred: runs an agent over caller-supplied tools/prompts/model and exposes the message trace. Benchmark-agnostic; reusable by any inspect-tool agentic SecurityClaim.
superred-target-dtap-scaffold
Shared scaffolding for the DecodingTrust-Agent (DTAP) superred targets: the agent-agnostic Target base, the security-domain forest, controllables/observables, env/MCP/Docker lifecycle, and the byte-faithful judge runner.
superred-optimizer-goat
GOAT (Generative Offensive Agent Tester) multi-turn jailbreak optimizer for superred
superred-optimizer-gepa-agentic
GEPA reflective prompt evolution optimizer for superred agent targets
superred-optimizer-gepa
GEPA reflective prompt evolution optimizer for superred
superred-optimizer-bijection
Bijection learning jailbreak optimizer for superred
superred-optimizer-autodan-turbo
AutoDAN-Turbo lifelong-strategy jailbreak optimizer for superred
superred
A modular framework for comprehensive red-teaming of AI systems
superred-claim-demo-secret-leak
Demo security claim for superred: a synthetic planted-secret scenario with a rigged trigger word. Not a real benchmark.
superred-optimizer-demo-prompt-list
Demo optimizer for superred: replays a fixed prompt list, ignores the goal, and does not learn. Not a real attack.
superred-target-minimal-llm-chat
Minimal single-turn LLM chat target for the superred red-teaming framework
