DeepTeam is a Python framework for red teaming LLM applications such as agents, RAG pipelines, and chatbots. You wrap your application in a model_callback function; DeepTeam then generates adversarial inputs for a chosen set of vulnerabilities, sends them through the callback, and scores the responses with LLM-as-a-judge metrics that run locally and return a binary pass or fail with reasoning. It does not need to know how the target system is built.
The framework is built on DeepEval and can use any LLM supported there for both attack generation and judging. Vulnerabilities cover data privacy, responsible AI, security, safety, business, and agentic categories, and attack methods include single-turn techniques (prompt injection, roleplay, encodings, context flooding) and multi-turn techniques (linear, tree, crescendo, and sequential jailbreaking). Frameworks such as OWASP Top 10 for LLMs, OWASP Top 10 for Agents, NIST AI RMF, and MITRE ATLAS map their categories to the matching vulnerabilities and attacks automatically.
Red teams can run from the CLI with YAML configs or programmatically in Python. Results are returned as risk assessments that can be displayed as dataframes or saved locally as JSON, and can optionally be uploaded to the Confident AI platform for reporting.
Features
- Callback-based targeting: a single model_callback wraps any LLM system; no knowledge of its internals is required
- Vulnerability catalog: PII and prompt leakage, bias, toxicity, BFLA, BOLA, RBAC bypass, shell and SQL injection, SSRF, misinformation, intellectual property, and more, each with explanations
- Agentic vulnerabilities: goal theft, recursive hijacking, excessive agency, indirect instruction, tool orchestration abuse, inter-agent communication compromise, and autonomous agent drift
- Single-turn attacks: prompt injection, roleplay, leetspeak, ROT13, Base64, gray box, multilingual, adversarial poetry, system override, permission escalation, and context poisoning
- Multi-turn attacks: linear, tree, crescendo, and sequential jailbreaking plus Bad Likert Judge
- Framework mappings: OWASP Top 10 for LLMs 2025, OWASP Top 10 for Agents 2026, NIST AI RMF, MITRE ATLAS, BeaverTails, and Aegis
- Guardrails: seven binary classifiers for guarding LLM inputs and outputs at runtime
- Custom vulnerabilities and attacks: define your own criteria in a few lines of code
- CLI and Python entry points: YAML-configured runs or the red_team function
- Local judging: LLM-as-a-judge metrics run on your machine and return pass or fail with reasoning