garak is a command-line vulnerability scanner for large language models. It checks whether a model or dialog system can be made to fail in unwanted ways, probing for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and other weaknesses. The tool positions itself for LLMs the way nmap or the Metasploit Framework work for networks, combining static, dynamic, and adaptive probes.
You point garak at a model with --targettype for the family or interface and --targetname for the specific model. By default it runs every probe it knows using each probe's recommended detectors, and you can narrow the run with --probes, down to a single plugin such as dan.Dan110. For each probe it prints a progress bar during generation and then a row per detector, marking undesirable responses as FAIL with a failure rate; details go to a .jsonl run log and errors to garak.log.
It connects to a wide range of targets, including Hugging Face Hub generative models (locally, via the Inference API, or private endpoints), OpenAI, Replicate, Cohere, Groq, AWS Bedrock, NVIDIA NIM, ggml/llama.cpp models, LiteLLM, and any REST endpoint returning plaintext or JSON. Most generators read their credentials from environment variables, and test generators exist for dry runs.
Probes span families such as encoding-based injection, DAN and DAN-like jailbreaks, atkgen automated attack generation driven by a red-teaming model, badchars imperceptible Unicode perturbations, gcg adversarial suffixes, glitch token discovery, and donotanswer prompts. An analysis script under analyse/ surfaces the probes and prompts that produced the most hits.
Features
- Failure probes: tests for hallucination, data leakage, prompt injection, misinformation, toxicity, and jailbreaks
- Probe selection: runs all probes by default, or narrows to a family or a single named plugin
- Broad target support: Hugging Face Hub, OpenAI, Replicate, Cohere, Groq, AWS Bedrock, NIM, ggml/llama.cpp, LiteLLM, and generic REST endpoints
- Detector-based scoring: each probe is evaluated by recommended detectors, with FAIL rows and failure rates per run
- Attack generation: atkgen uses a red-teaming model to adapt its prompts to the target's responses
- Adversarial techniques: encoding injections, gcg suffix attacks, badchars Unicode perturbations, and glitch-token discovery
- Run logging: per-run .jsonl logs plus an analysis script that ranks the most effective probes and prompts
- Test generators: blank and repeat generators for dry runs and pipeline checks
