Case study / LLM security research
An automated red-teaming framework that runs garak, PyRIT, and a browser module as one reproducible campaign.
Signals moving through a network; violet marks adversarial input
Overview
Red-team tools for language models each come with their own configuration, prompts, scoring, and output format. A garak run and a PyRIT campaign against the same model produce results you can't line up, and re-running either one later rarely reproduces the original conditions.
That's a problem for research, where the whole point is a fair before-and-after comparison. BadToken's goal is to put the tools behind one interface and one evidence format so an adversarial evaluation can be repeated and compared rather than reconstructed from scratch.
When a model refuses a harmful request, is the refusal doing the work, or is the model simply unable to do the task? Separating "won't" from "can't" changes how you read every attack-success number.
Architecture
Step 1
A campaign starts in the engine. The scheduler decides which module runs which attack against which target, using the same probe, generation, and seed settings every time it's re-run.
Step 2
Modules do the work they're best at: garak runs its probe library, PyRIT orchestrates multi-turn attacks, and WebRedTeam drives a real browser against LLM-backed web apps. X-Ray is parked as a future module.
Step 3
Each module writes its results into one shared evidence format, so a garak hit and a PyRIT transcript can sit side by side instead of living in two incompatible logs.
Step 4
One campaign produces one findings report that can be compared run to run, which is what a before-and-after experiment needs.
The library's intended interface
import BadToken # run the standard scan suite against a served model report = BadToken.scan(model) # run one specific exploit against it result = BadToken.test(model, exploit)
Implementation
Models are served with vLLM behind an OpenAI-compatible endpoint on A100 GPU nodes in the university research cluster, scheduled through Slurm and reached over an authenticated SSH tunnel. The garak and PyRIT clients run in a separate conda environment so the serving stack stays untouched.
I also maintain the group's cluster reference documentation: session startup, Slurm and tmux commands, storage paths, environment pins, and a model-size table.
Methodology
Outcomes
Repository
The BadToken repository isn't public yet; it will be linked here when it is. Next up: the web module described in the WebRedTeam case study, and indirect prompt injection carried in images rather than text, reproducing Nassi et al. (Black Hat Europe 2023).