{ "format": "agent-article-v0", "article_id": "EA-106", "canonical_url": "/tools/ea-106-automated-ai-red-team", "page_type": "reference", "claim_ids": [], "evidence_ids": [ "EVD-EA-106-URL-ABA597EA427E", "EVD-EA-106-URL-DE044838CF94", "EVD-EA-106-URL-54DBC1541342", "EA-106-R11-RESEARCH", "EA-106-R11-WEB-READBACK" ], "unknown_ids": [ "EA-106-UNKNOWN-01", "EA-106-UNKNOWN-CURRENTNESS" ], "operational_object_ids": [], "provider": [ "Microsoft" ], "models": [], "plans": [], "surfaces": [], "regions": [], "current_status": "UNKNOWN", "observation_status": "SPEC_ONLY", "freshness": "UNKNOWN", "last_verified": null, "supersedes": [], "superseded_by": [], "provenance": [ "COMM-039-EA0106", "SRC-EA-106-URL-ABA597EA427E", "SRC-EA-106-URL-DE044838CF94", "SRC-EA-106-URL-54DBC1541342", "WEBBODY-EA0106-R8-9BC307E9" ], "article_sources": [ { "id": "EVD-EA-106-URL-ABA597EA427E", "evidence_class": "RESEARCH", "title": "1) source class: author-maintained OSS implementation; exact title: Python Risk Identification Tool for generative AI (PyRIT); author/org: Microsoft; canonical URL:", "href": "https://github.com/microsoft/PyRIT", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-106-URL-ABA597EA427E" ], "supporting_locators": [ "EVIDENCE TABLE", "1) source class: author-maintained OSS implementation; exact title: Python Risk Identification Tool for generative AI (PyRIT); author/org: Microsoft; canonical URL: https://github.com/microsoft/PyRIT" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-106-URL-DE044838CF94", "evidence_class": "RESEARCH", "title": "2) source class: author-maintained OSS implementation; exact title: garak, LLM vulnerability scanner; author/org: NVIDIA; canonical URL:", "href": "https://github.com/NVIDIA/garak", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-106-URL-DE044838CF94" ], "supporting_locators": [ "EVIDENCE TABLE", "2) source class: author-maintained OSS implementation; exact title: garak, LLM vulnerability scanner; author/org: NVIDIA; canonical URL: https://github.com/NVIDIA/garak" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-106-URL-54DBC1541342", "evidence_class": "RESEARCH", "title": "3) source class: official framework; exact title: Artificial Intelligence Risk Management Framework; author/org: NIST; canonical URL:", "href": "https://www.nist.gov/itl/ai-risk-management-framework", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-106-URL-54DBC1541342" ], "supporting_locators": [ "EVIDENCE TABLE", "3) source class: official framework; exact title: Artificial Intelligence Risk Management Framework; author/org: NIST; canonical URL: https://www.nist.gov/itl/ai-risk-management-framework" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EA-106-R11-RESEARCH", "evidence_class": "RESEARCH", "title": "EA-106 監査済みresearch / canonical revision binding", "supports": [ "PyRITはMicrosoft-maintained open-source risk identification framework、garakはNVIDIA-maintained LLM vulnerability scannerとして、攻撃/弱点probeの自動化部品を提供する。NIST AI RMFは評価をrisk management lifecycleへ置く。よって自動red teamはfixture→probe→判定→triage→修正→再試験の回帰工程へ置けるが、tool出力は脆弱性の発見信号であり、全攻撃面の網羅証明ではない。" ], "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。", "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET", "source_or_experiment_ids": [ "COMM-039-EA0106" ], "supporting_locators": [ "COMM-039-EA0106", "EA-106-R5-LEGACY-MIGRATION-20261008-R1", "content/staging/EA-106.md" ], "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。", "provenance_status": "AUDIT_PASS_CANONICAL_BINDING" }, { "id": "EA-106-R11-WEB-READBACK", "evidence_class": "IMPL", "title": "EA-106 Web body identity / canonical readback", "supports": [ "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。" ], "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。", "checked_at": null, "origin_class": "IMPLEMENTATION_READBACK", "source_or_experiment_ids": [ "WEBBODY-EA0106-R8-9BC307E9" ], "supporting_locators": [ "WEBBODY-EA0106-R8-9BC307E9", "content/staging/EA-106.md", "EA-106-R5-LEGACY-MIGRATION-20261008-R1" ], "scope": "R9/R10 canonical readback後のProduction生成時body identity。", "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH" } ], "research_sections": [ { "heading": "WHY_THIS_MATTERS_TO_UPDATE", "text": "prompt injection、tool abuse、情報漏洩等は単発の手作業では回帰検出しにくい。自動fixtureを継続実行する場合も、攻撃ツールの出力を実被害や安全保証へ外挿してはならない。" }, { "heading": "SCOPE_ROUTING", "text": "Enterprise AI Core / security / benchmark / implementation / safe evaluation" }, { "heading": "CLAIM_OR_RESEARCH_QUESTION", "text": "PyRITとgarakは自動red-team/evaluationのどの範囲を実装し、継続運用で何が未確立か。" }, { "heading": "EVIDENCE TABLE", "text": "1) source class: author-maintained OSS implementation; exact title: Python Risk Identification Tool for generative AI (PyRIT); author/org: Microsoft; canonical URL: https://github.com/microsoft/PyRIT; publication/update/access: current repository accessed 2026-09-13; version/release: repository current, migrated from Azure/PyRIT; supporting locator: README lines 196-214（open source framework、generative AI risk identification、red-team topics）; evidence label: OSS_PRACTICE + PRODUCT_VOLATILE; relation: support / limit。\n2) source class: author-maintained OSS implementation; exact title: garak, LLM vulnerability scanner; author/org: NVIDIA; canonical URL: https://github.com/NVIDIA/garak; publication/update/access: current repository accessed 2026-09-13; version/release: repository current; supporting locator: README lines 190-194（hallucination, data leakage, prompt injection, misinformation, toxicity, jailbreak等のprobe対象）; evidence label: OSS_PRACTICE + PRODUCT_VOLATILE; relation: support / limit。\n3) source class: official framework; exact title: Artificial Intelligence Risk Management Framework; author/org: NIST; canonical URL: https://www.nist.gov/itl/ai-risk-management-framework; publication/update/access: 2023-01-26, page accessed 2026-09-13; version/release: AI RMF 1.0 / AI 600-1 GenAI Profile; supporting locator: lines 132-138（design/development/use/evaluationとGenAI固有risk management）; evidence label: VERIFIED_SPEC; relation: governance context。" }, { "heading": "FINDINGS", "text": "PyRITはMicrosoft-maintained open-source risk identification framework、garakはNVIDIA-maintained LLM vulnerability scannerとして、攻撃/弱点probeの自動化部品を提供する。NIST AI RMFは評価をrisk management lifecycleへ置く。よって自動red teamはfixture→probe→判定→triage→修正→再試験の回帰工程へ置けるが、tool出力は脆弱性の発見信号であり、全攻撃面の網羅証明ではない。" }, { "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE", "text": "OSSのREADMEは実装目的・対象を示すが、全モデル/全versionの検出率、false negative、実tenantの安全性を保証しない。攻撃payloadを本番toolへ向ける安全性も別問題。" }, { "heading": "AVAILABILITY_GATES", "text": "対象モデル/agent、tool permissions、network isolation、data classification、fixture provenance、rate/stop limit、human review、result retention、version pin。" }, { "heading": "IMPLEMENTATION_STATE", "text": "実装状態: 無認証・非破壊のlocal/mock targetへ限定したred-team pipelineを設計。認証済みtenant、外部書込み、secret投入は未実施。" }, { "heading": "BENCHMARK_OR_EVAL", "text": "Evaluation: mock toolとsynthetic secretを用いたprompt injection/data exfiltration/unsafe tool request fixture、再現可能なseed、pass/fail oracle、回帰差分を設計。実運用攻撃はしない。" }, { "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY", "text": "SECURITY: sandbox・egress deny・kill switch。PRIVACY: synthetic data only。AUDIT: probe/version/payload hash/result/triage。COST: probe数・model calls・review時間を計測対象とする。" }, { "heading": "SAFE_WORDING_FOR_FUTURE_BOOK", "text": "「PyRITとgarakは生成AI/LLMのリスクprobeを自動化するOSS部品である。probeが通過したことは安全性の証明ではなく、対象・version・fixture・設定に依存する。」" }, { "heading": "UPDATE_WORK_HANDOFF", "text": "本文はred-team tool名だけでなく、target、攻撃面、fixture、判定、再現性、停止条件、未検出リスクを記載する。" }, { "heading": "OPEN_UNKNOWN", "text": "agent/tool連鎖へのcoverage、多言語/multimodal、rate-limit下の再現性、judge reliability、provider policyとの衝突、OSS version差。" }, { "heading": "STOP_CONDITION", "text": "実targetへの攻撃を開始せず、safe TEST_PROFILEとmock side effectが先に揃わない限り停止。\nUNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED\n\n---" }, { "heading": "AUDITED_CURRENTNESS_BOUNDARY", "text": "PyRIT/garak release behavior is version-dependent PRODUCT_VOLATILE; automated red-team tooling remains regression evidence, not safety proof." } ], "human_url": "/tools/ea-106-automated-ai-red-team", "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-106-automated-ai-red-team", "json_url": "/agent/article.json?path=%2Ftools%2Fea-106-automated-ai-red-team" }