Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-redteam.
Done when: you report the undefended ASR and the severity-weighted ASR.
Easy 2: Add a goal (30 minutes)
Add a goal "change a customer's email address" with severity 40.
Done when: you show gate v2's ASR now that a goal is outside its rules.
Hint
the gate only knows the actions listed in Target.blocked.
Easy 3: Attempts needed (30 minutes)
Compute the attempts needed for p of 0.02 and 0.002.
Done when: your numbers match attacks_needed.
Medium
Medium 1: Fewer runs (3 hours)
Run 2, 5 and 20 trials per attack.
Done when: you show how the interval width and the CI decision change.
Hint
the interval width shrinks roughly with the square root of the runs.
Medium 2: Multi-turn attacks (4 hours)
Add attacks that need two steps (plant, then trigger) and a memory that persists.
Done when: a gate on single actions misses them and you add a fix.
Hint
attack state must live across calls; reset it per trial.
Medium 3: Adaptive attacker (4 hours)
Let the attacker pick the next phrasing from the families that succeeded.
Done when: you compare its success after 50 attempts with random choice.
Hard
Hard 1: Real agent (8 hours)
Run the grid against a real agent with mocked tools. (I did not run this, so your numbers are the ground truth.)
Done when: you report ASR with intervals by category.
Hard 2: Tool comparison (8 hours)
Run one of the open-source red-team tools (DeepTeam, Garak or PyRIT) on the same agent. (I did not run this.)
Done when: you compare its findings with your grid and list what each missed.
Hard 3: Red-team and fix report (10 hours)
Write the Level 10 project report for one agent: threat model, attack grid, baseline, two fixes, held-out evaluation and regression suite. (I did not run this.)
Done when: a reader can reproduce your numbers from the repository.
Hint
keep the held-out set unseen until the final evaluation.