Red teaming · Concepts

Architecture

AgentLeak turns an attack matrix into channel-aware evidence. Generation and delivery are isolated from detection and scoring so the evaluator does not need to trust the target agent.

Mental model

Scope + vault→Plugins×Strategies→Target adapter→Normalized trace→Detectors→AgentRisk + evidence

Components

Campaign planner

Validates presets, plugin IDs, strategies, adversary level and budget.

Scenario generator

Maps each plugin to F1–F6 attack classes and injects synthetic canary-backed vault records.

Strategy engine

Transforms payload delivery without changing the vulnerability being measured.

Target adapter

Runs a deterministic scripted agent or calls an authorized OpenAI-compatible live endpoint.

Trace normalizer

Records user input, tools, memory, messages, logs, files and final output in one event model.

Evaluation engine

Runs deterministic detectors, optional Presidio/LLM judge, policy assertions and AgentRisk scoring.

Evidence store

Persists redacted findings, run IDs, coverage, metrics and remediation for comparisons.

Public catalog

Publishes executable plugin/strategy capabilities and compatibility metadata.

Campaign lifecycle

1Validate

Reject unknown or impossible combinations before a target call.

2Generate

Select attack classes and create synthetic vault/canary fixtures.

3Deliver

Apply a strategy and submit one or more attack turns.

4Capture

Record every target event in chronological order.

5Detect

Find direct, encoded and contextual sensitive disclosures.

6Score

Compute per-run risk, policy result and campaign metrics.

7Report

Return coverage gaps, attacks, evidence and remediation.

Data flow and contracts

The target receives the attack context; the evaluator receives the resulting trace. Raw matched values are redacted from API summaries. The canonical contracts are published through /api/schemas and /openapi.json.

CampaignRequest → AdversarialScenario → Trace<Event>
Trace + CanarySet + DetectorConfig → AnalysisReport
AnalysisReport[] + coverage → CampaignMetrics + remediation

Trust and privacy boundaries

VaultUse synthetic records and canaries; never seed production secrets merely to test detection.

TargetTreat all target output and tools as untrusted event content.

EvaluatorKeep deterministic evaluation local by default; semantic judging is explicit BYOK.

ProviderLive prompts, tool output and memory may leave your environment under the provider's terms.

EvidenceStore redacted values and stable finding IDs; restrict access to raw traces.

Scripted and live execution share the evaluator

Only the target adapter changes. This lets teams validate detector recall offline, then measure real defenses without changing trace, finding, score or report contracts.

Extension points

Add target adapters at the execution boundary, detector rules at the analysis boundary and plugins by mapping observable risks to attack classes. New strategies must transform delivery while preserving the plugin's success condition.