LLM Red Team Skill Catalog — AATMF v3

---
name: llm-redteam-overview-ee8a3e1ff39a
description: "LLM red team category — full AATMF v3 tactic coverage (T01–T15). Routing skill: read this first to identify which tactic applies, then load the matching sub-skill. Maps to MITRE ATLAS where overlap exists."
allowed-tools: Bash Read Write
metadata:
  subdomain: ai-security
  when_to_use: "llm, ai, model, gpt, claude, prompt, jailbreak, ai red team, prompt injection, llm exploit, aatmf, atlas, agentic, rag, multimodal, training data, model poisoning, output filter bypass"
  tags: ai-security, llm, aatmf, atlas
  mitre_attack: T1606
  aatmf_framework: v3
---

# LLM Red Team Skill Catalog — AATMF v3

This is the **routing skill** for AI/LLM red-team work. The 15 sub-skills below cover every tactic in the AI/ML Adversarial Tactics, Techniques & Mitigations Framework (AATMF v3). Load the specific sub-skill that matches the attacker objective.

## Tactic Map

| Tactic | Sub-Skill | Covers | Load Path |
|---|---|---|---|
| T01 | **prompt-injection** | Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt leaking | `load_skill("/skills/plugins/llm-redteam/t01-prompt-injection/SKILL.md")` |
| T02 | **linguistic-evasion** | Translation/transliteration bypass, base64/leetspeak/emoji encoding, low-resource-language jailbreak, multi-lingual context split | `load_skill("/skills/plugins/llm-redteam/t02-linguistic-evasion/SKILL.md")` |
| T03 | **reasoning-exploit** | CoT / ReAct hijack, math/logic distractor, role-play escalation, hypothetical / counterfactual framing | `load_skill("/skills/plugins/llm-redteam/t03-reasoning-exploit/SKILL.md")` |
| T04 | **memory-manipulation** | Long-context overflow, conversation rewrite, sliding-window poisoning, "previous turn" forgery | `load_skill("/skills/plugins/llm-redteam/t04-memory-manipulation/SKILL.md")` |
| T05 | **api-exploitation** | Function-calling abuse, tool-schema confusion, parameter pollution, response-format coercion | `load_skill("/skills/plugins/llm-redteam/t05-api-exploitation/SKILL.md")` |
| T06 | **training-poisoning** | Backdoor trigger injection, label flip, RLHF reward hacking, fine-tune dataset contamination | `load_skill("/skills/plugins/llm-redteam/t06-training-poisoning/SKILL.md")` |
| T07 | **output-exfil** | Data-leak via reflection, side-channel via length/timing, watermark stripping, token-by-token exfil | `load_skill("/skills/plugins/llm-redteam/t07-output-exfil/SKILL.md")` |
| T08 | **deception** | Confident-hallucination weaponization, persona impersonation, source spoofing, "as the system says" framings | `load_skill("/skills/plugins/llm-redteam/t08-deception/SKILL.md")` |
| T09 | **multimodal** | Image/audio prompt injection, OCR-payload, steganographic prompts, adversarial perturbations | `load_skill("/skills/plugins/llm-redteam/t09-multimodal/SKILL.md")` |
| T10 | **confidentiality-breach** | System-prompt extraction, weight inference, training-data extraction, PII echo | `load_skill("/skills/plugins/llm-redteam/t10-confidentiality-breach/SKILL.md")` |
| T11 | **agentic-exploit** | Tool-chain hijack, autonomous-loop poisoning, plan-injection, sub-agent confusion | `load_skill("/skills/plugins/llm-redteam/t11-agentic-exploit/SKILL.md")` |
| T12 | **rag-poisoning** | RAG index injection, document smuggling, embedding-collision, retrieval-rank gaming | `load_skill("/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md")` |
| T13 | **supply-chain** | Model registry tampering, dependency confusion (HF Hub, Ollama, MCP), serialization payload abuse | `load_skill("/skills/plugins/llm-redteam/t13-supply-chain/SKILL.md")` |
| T14 | **infra-warfare** | GPU resource abuse, billing-amplification, rate-limit DoS, cold-start abuse, region failover poisoning | `load_skill("/skills/plugins/llm-redteam/t14-infra-warfare/SKILL.md")` |
| T15 | **human-ai-coupling** | Operator manipulation via AI output, social engineering uplift, dark-pattern UX exploiting AI trust | `load_skill("/skills/plugins/llm-redteam/t15-human-ai-coupling/SKILL.md")` |

## Quick Routing

```
Target type identified?
├── Chat-only LLM endpoint     → T01, T02, T03, T10
├── LLM with tools / function calling → T05, T11
├── LLM with RAG / retrieval     → T12, T01 (indirect)
├── LLM with multimodal input    → T09
├── Fine-tuned / custom model    → T06, T10 (extraction)
├── Cross-tenant / shared infra  → T14, T13
└── Human-in-the-loop product    → T15, T08
```

## Tooling

| Tool | Use |
|---|---|
| `promptfoo` | Plugin-based red-team eval — declarative test cases, runs all 15 tactic plugins |
| `garak` | NVIDIA's LLM vulnerability scanner — alignment, jailbreak, leak probes |
| `pyrit` | Microsoft's open red-team automation framework |
| `agentdojo` | Agentic-system specific (T11) — sandboxed tool-chain attack benchmark |
| `LangSmith / Langfuse` | Observation surface — replay attacks against deployed agents |

## Cross-Reference

- **MITRE ATLAS** — covers tactic-level coverage (Reconnaissance → Impact). AATMF is more attacker-procedure focused. Most AATMF techniques map to one or more ATLAS techniques; the sub-skills note the mapping in their frontmatter.
- **OWASP LLM Top 10** — risk-class level. AATMF tactics map across LLM01-LLM10.
- **NIST AI RMF AI 600-1** — governance lens; AATMF gives the offensive counterpart.

## When in doubt

If the target's surface or behavior doesn't cleanly match one tactic, run a **T01 + T05 probe** first — direct prompt injection and function-call abuse are the most common, highest-yield starting points and their results inform which other tactics are reachable.