issue_refund().Fire every attack many times and measure Attack Success Rate with 95% Wilson confidence intervals. This is why real red-teaming runs hundreds of trials: model behavior is probabilistic, so a single run tells you almost nothing — the distribution does.
Each layer has a detection rate (probability it catches a covered attack on a given trial) — real detectors are imperfect. Fuzz mutations lower the effective rate. Toggle layers, then re-run the campaign to watch ASR move.
Evaluate an input detector against a labeled corpus (malicious + benign look-alikes) — the real precision/recall tradeoff of text-based filtering.
There is no fixed number — the space is open and growing. In practice it clusters into the families below. For scale: NVIDIA garak tracks ~120 probe categories, Promptfoo 50+ vulnerability types, and new families (adversarial suffixes, many-shot, Crescendo, Skeleton Key, policy-puppetry) keep appearing. The defensive point is that you enumerate families, not individual strings — you can only defend what you can name.
| Family | Illustrative technique | Primary defense |
|---|
Red-team / offense (test your own systems)
Defense / runtime guardrails
No single tool covers everything. The consensus 2026 stack: garak for breadth (model sweep), PyRIT for depth (multi-turn campaigns), Promptfoo for CI/CD gates, DeepTeam for OWASP mapping — paired with a runtime guardrail (LLM Guard / NeMo / Lakera) and least-privilege tool scoping. Tool facts here reflect public reporting as of Aug 2026; verify current versions and licenses before adopting.
Each probe module targets one vulnerability class and carries many prompts; garak fires each prompt ~10× by default because output is non-deterministic — a 1-in-10 bypass is still a finding. Run --probes promptinject,encoding,latentinjection,suffix,tap,xss or all by default.
| Probe | What it tests |
|---|
A library of swappable parts — attacks/orchestrators (the loop), converters (payload mutation), scorers (success judgement). Its edge is multi-turn depth and converter chaining across text/image/audio/video.
| Component | What it does |
|---|
Separates plugins (what to test) from strategies (how to deliver), wired via YAML in your repo. Framework presets map a scan straight onto a compliance taxonomy.
| Item | What it covers |
|---|
The named techniques driving recent tooling updates. Tools race to add them, so "how many families" is a moving target — this is the current front line, not a closed set.
| Family | Origin | Mechanism |
|---|
There is overlap, and it clusters where you'd expect. All three test the LLM01 core (prompt injection + jailbreaks); they diverge by layer and workflow. The shared centre is "everyone covers this, redundantly"; the outer crescents are "only this tool gives you this".
Runtime filters placed at distinct control points around the model. No single point can perfectly filter free-flow text, so production systems layer them — each rail catches a different vector, and the output rail runs independently of the prompt path so a compromised model cannot talk its way past it.
A guardrail scores every prompt instantly and routes it. The hard part is the doubt band: if you ask the person "did you really mean this?", an attacker just says yes. So you never let the actor self-certify — you verify something they can't fake.
RAG = Retrieval-Augmented Generation. Rather than hoping the model memorized your data, you retrieve the right snippets from your own documents and hand them to the model with the question. Two pipelines: one prepares the data ahead of time, one runs on every question.
Most enterprise use clusters into a few patterns. The badge shows what's under the hood: plain LLM just the model, RAG model + your data, agentic model + tools/actions.