deepteam - DeepTeam is a framework to red team LLMs and AI ag

项目说明

<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/hero/wordmark-dark-v2.svg">
<img alt="DeepTeam." src="assets/hero/wordmark-light-v2.svg" width="520">
</picture>
</p>

<h1 align="center">The LLM Red Teaming Framework</h1>

<h4 align="center">
<p>
<a href=" |
<a href="#-and-features">, Attacks, and Features</a> |
<a href="#-quickstart">Getting Started</a> |
<a href="#deepteam-with-confident-ai">Confident AI</a>
<p>
</h4>

<p align="center">
<a href="
<img alt="GitHub release" src="
</a>
<a href="
<img alt="discord-invite" src="
</a>
<a href="
<img alt="License" src="
</a>
</p>

<p align="center">
<a href=" |
<a href=" |
<a href=" |
<a href=" |
<a href=" |
<a href=" |
<a href=" |
<a href="
</p>

DeepTeam is a simple-to-use, open-source red teaming framework for LLM systems. Think of it as penetration testing, but for LLMs.

DeepTeam simulates attacks — jailbreaking, prompt injection, multi-turn exploitation, and more — to unco like bias, PII leakage, and SQL injection in your AI agents, RAG pipelines, and chatbots. It also offers guardrails to prevent these issues in production.

DeepTeam runs locally on your machine and is built on DeepEval, the open-source LLM e framework.

> [!IMPORTANT]
> Need a place for your red teaming results to live? Sign up to the Confident AI platform to manage risk assessments, monitor in production, and share reports with your team.

<p align="center">
<img src=" alt="Confident AI + DeepTeam" width="100%">
</p>

> Want to talk LLM security, need help picking attacks, or just to say hi? Come join our discord.

&nbsp;

🔥 , Attacks, and Features

- <details>
<summary><b>Data Privacy</b></summary>

- PII Leakage — disclosure of sensiti information
- Prompt Leakage — exposure of system prompt secrets and instructions

</details>

- <details>
<summary><b>Responsible AI</b></summary>

- Bias — stereotypes and unfair treatment across gender, race, religion, politics
- Toxicity — harmful, offensive, or demeaning content
- Child Protection — child-related privacy and safety risks
- Ethics — of moral reasoning and organizational
- Fairness — discriminatory outcomes across groups and contexts

</details>

- <details>
<summary><b>Security</b></summary>

- BFLA — broken function-le
- BOLA — broken object-le
- RBAC — role-based access control bypass
- Debug Access — unauthorized access to debug modes and de
- Shell Injection — unauthorized system command execution
- SQL Injection — database query manipulation
- SSRF — ser request forgery to internal services
- Tool Metadata Poisoning — corrupted tool schemas and descriptions
- Cross-Context Retrieval — data access across isolation boundaries
- System Reconnaissance — probing internal architecture and configurations

</details>

- <details>
<summary><b>Safety</b></summary>

- Illegal Activity — facilitation of fraud, weapons, drugs, or other unlawful actions
- Graphic Content — explicit, , or sexual material
- Personal Safety — self-harm, harassment, or dangerous advice
- Unexpected Code Execution — coerced execution of unauthorized code

</details>

- <details>
<summary><b>Business</b></summary>

- Misinformation — factual errors and unsupported claims
- Intellectual Property — copyright, trademark, and patent
- Competition — competitor endorsement and market manipulation

</details>

- <details>
<summary><b>Agentic</b></summary>

- Goal Theft — extracting or redirecting an agent's objectives
- Recursi — self-modifying goal chains that alter objectives
- Excessi — agents acting beyond their authority
- Robustness — input o and prompt hijacking
- Indirect Instruction — hidden instructions in retrie
- Tool Orchestration Abuse — exploiting tool calling sequences
- Agent Identity & Trust Abuse — impersonating agent identity
- Inter-Agent Communication Compromise — spoofing multi-agent message passing
- Autonomous Agent Drift — agents de from intended goals over time
- Exploit Tool Agent — weaponizing tools for unintended actions
- External System Abuse — using agents to attack external services

</details>

- <details>
<summary><b>Custom</b></summary>

- Custom — define and test your own criteria in a few lines of code

</details>

- <details>
<summary><b>Single-Turn</b></summary>

- Prompt Injection — crafted injections that bypass LLM restrictions
- Roleplay — persona-based scenarios exploiting collaborati
- Leetspeak — symbolic character substitution to avoid keyword detection
- ROT13 — alphabetic rotation to evade content filters
- Base64 — encoding attacks as random-looking data
- Gray Box — le partial system knowledge for targeted attacks
- Math Problem — disguising attacks within mathematical inputs
- Multilingual — translating attacks to less-spoken languages
- Prompt Probing — probing the LLM to extract system prompt details
- Ad Poetry — transforming attacks into poetic verse with metaphor
- System O — disguising attacks as legitimate system commands
- Permission Escalation — shifting percei to bypass role restrictions
- Goal Redirection — reframing agent objectives for unauthorized outcomes
- Linguistic Confusion — semantic ambiguity to confuse language understanding
- Input Bypass — circum handling claims
- Context Poisoning — injecting false background context to bias reasoning
- Character Stream — character-by-character input to bypass filters
- Context Flooding — flooding input with benign text to hide malicious instructions
- Embedded Instruction JSON — hiding attacks inside realistic JSON structures
- Synthetic Context Injection — fabricating system context to exploit long-context handling
- Authority Escalation — framing requests from positions of power
- Emotional Manipulation — high-intensity emotional pressure for unsafe compliance

</details>

- <details>
<summary><b>Multi-Turn</b></summary>

- Linear Jailbreaking — iteratively refining attacks using target LLM responses
- Tree Jailbreaking — exploring parallel attack to find the best bypass
- Crescendo Jailbreaking — gradual escalation from benign to harmful prompts
- Sequential Jailbreak — multi-turn con scaffolding toward restricted outputs
- Bad Likert Judge — exploiting Likert scale e roles to extract harmful content

</details>

&nbsp;

🚀 QuickStart

DeepTeam does not require you to define what LLM system you are red teaming — because neither will malicious users. All you need to do is install deepteam, define a model_callback, and you're good to go.

Installation

Red Team Your First LLM

Don't forget to set your OPENAI_API_KEY as an en before running (you can also use any custom model supported in DeepEval), and run the file:

That's it! Your first red team is complete. Here's what happened:

Unlike traditional e, red teaming does not require a prepared dataset — ad attacks are dynamically generated based on the you want to test for.

&nbsp;

Red Team Against Safety Frameworks

Use established AI safety standards like OWASP and NIST instead of manually picking :

This automatically maps the framework's categories to the right and attacks. A frameworks include OWASPTop10, OWASP_ASI_2026, NIST, MITRE, Aegis, and Bea.

&nbsp;

Guard Your LLM in Production

Once you' your , use DeepTeam's guardrails to prevent them in production:

7 guards are a out-of-the-box: ToxicityGuard, PromptInjectionGuard, Pri, IllegalGuard, HallucinationGuard, TopicalGuard, and CybersecurityGuard. Read the full guardrails docs here.

&nbsp;

DeepTeam with Confident AI

Confident AI is the all-in-one platform that integrates natively with DeepTeam and DeepEval.

<p align="center">
<img src=" alt="Confident AI" width="90%">
</p>

&nbsp;

Contributing

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us.

&nbsp;

Authors

Built by the founders of Confident AI. Contact for all enquiries.

&nbsp;

License

DeepTeam is licensed under Apache 2.0 - see the LICENSE.md file for details.

项目信息

开发语言：Python

Star 数：2986

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕DeepTeam is a framework to red team LLMs and AI agents.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。