32  AI Red-Team Loop

33 AI Red-Team Loop

Working seal: stack://ai-red-team-loop/6CF8F7698D

Enter: Use when an LLM-assisted workflow needs controlled adversarial testing for prompt injection, jailbreak pressure, leakage, or tool misuse.

33.1 Related Runes

• 1054 threat model - A structured view of likely attackers, assets, and failure paths.
• 1390 prompt injection - prompt injection is a promptcraft and AI-assisted engineering rune for bind model behavior to role, context, output contract, and evidence; use it when the artifact needs the prompt injection obligation named before work proceeds.
• 1374 guardrail - A boundary that narrows allowed behavior without fully specifying the answer.
• 1034 quarantine - quarantine is a security and trust rune for make identity, authority, secrecy, and enforcement boundaries auditable; use it when the artifact needs the quarantine obligation named before work proceeds.
• 1042 sandbox {Sec} - Constrain code inside a smaller, safer prison.
• 1017 least privilege - Give only the authority required for the present act, no more. It is one of the simplest words for reducing future regret.
• 1364 evaluation {AI} - The act of measuring whether the model is actually useful.
• 1414 tool call - A step where the model reaches beyond text into external action.

33.2 Related Spell Templates and References

• Jailbreak Resilience Review
• Bug Diagnosis From Logs
• Stack Grammar
• Failure Modes
• Canon Map | Step | Spell | Artifact | Advance when | | —- | ——————— | —————————————————————————– | —————————————————————– | | 1 | Threat model | Assets, trust boundaries, allowed tools, untrusted inputs, and attacker goals | The security boundary and benign task are explicit | | 2 | Build defanged probes | Harmless fixture prompts and canary-bearing test inputs | Probes preserve attack shape without operational payloads | | 3 | Run in sandbox | Prompt, transcript, fixture version, and tool-scope record | The model output and tool behavior are captured verbatim | | 4 | Score resistance | Attack-resistance, utility-preservation, and audit-quality scores | Scores cite the transcript and fixture expectations | | 5 | Mitigate | Prompt, policy, retrieval, or tool-scope repair | The repair addresses the observed failure without blanket refusal | | 6 | Replay | Repeated run set across fixture versions or model surfaces | The failure is fixed or residual risk is accepted explicitly | | 7 | Report | Defensive finding with source map, evidence, mitigation, and residual risk | A maintainer can reproduce the finding without unsafe payloads |

33.3 Loop or Recursion

{
  "steps": [
    2,
    3,
    4,
    5,
    6
  ],
  "until": "Attack resistance and utility preservation meet the release threshold, or residual risk is documented for human review"
}

33.4 On Fail

Stop the test if a probe would require operational harmful content; replace it with a defanged skeleton and record the omitted class of detail.

33.5 Why It Works

It treats adversarial promptcraft as evidence-producing security work instead of social-media prompt collecting.