DeepTeam

Overview

DeepTeam (by Confident AI) is a Python framework for red-teaming LLMs and LLM-based agents, run as a pytest-like harness against a target model callback. It ships 40+ vulnerability definitions (bias, PII leakage, misinformation, excessive agency, etc.) and 20+ attack methods (prompt injection, jailbreak chains, encoding-based bypasses, multi-turn escalation) explicitly mapped to the OWASP Top 10 for LLM Applications, so results translate directly into a compliance-flavored report.

Installation

Install from PyPI

pip install deepteam

Set your judge-LLM API key (used to grade attack success)

export OPENAI_API_KEY="<api_key>"

Defining the target callback

# my_target.py
def model_callback(prompt: str) -> str:
    # Wire this up to whatever you're testing: a REST API, a local model, an agent
    response = call_target_llm(prompt, endpoint="<target_url>", model=" <model_name>")
    return response

Running a red team

from deepteam import red_team
from deepteam.vulnerabilities import Bias, PIILeakage, ExcessiveAgency
from deepteam.attacks.multi_turn import CrescendoJailbreaking
from deepteam.attacks.single_turn import PromptInjection
from my_target import model_callback

risk_assessment = red_team(
    model_callback=model_callback,
    vulnerabilities=[Bias(), PIILeakage(), ExcessiveAgency()],
    attacks=[PromptInjection(), CrescendoJailbreaking()],
)

print(risk_assessment.overview)      # summary pass/fail per vulnerability
risk_assessment.save("report.json")

CLI usage (config-driven)

Scaffold a config

deepteam config init

Run against the config

deepteam run deepteam_config.yaml

# deepteam_config.yaml
target:
  callback: my_target.model_callback

vulnerabilities:
  - type: pii_leakage
  - type: excessive_agency
  - type: misinformation

attacks:
  - type: prompt_injection
  - type: linear_jailbreaking
  - type: crescendo_jailbreaking

Tips

• DeepTeam reuses DeepEval’s assertion/metrics engine under the hood — if you already have DeepEval test suites, integration is straightforward.
• Vulnerabilities/attacks are explicitly OWASP-LLM-mapped (LLM01: Prompt Injection, LLM06: Excessive Agency, etc.) — handy when a client wants a compliance-style writeup.
• Run it in CI as a pytest module (deepteam exposes pytest-style assertions) to gate PRs on regressions in agent safety behavior.

deepteam <command> [options]

COMMANDS:
  config init               Scaffold a deepteam_config.yaml
  run <config.yaml>          Execute red team run from config file

PYTHON API:
  from deepteam import red_team
  red_team(model_callback, vulnerabilities=[...], attacks=[...])

VULNERABILITY CLASSES (deepteam.vulnerabilities):
  Bias, Toxicity, Misinformation, PIILeakage, ExcessiveAgency,
  Robustness, IllegalActivity, GraphicContent, PersonalSafety, ...

ATTACK CLASSES:
  single_turn: PromptInjection, Base64, ROT13, Leetspeak, PromptProbing
  multi_turn:  LinearJailbreaking, TreeJailbreaking, CrescendoJailbreaking

OUTPUT:
  risk_assessment.overview     Summary pass/fail per vulnerability
  risk_assessment.save(path)    Write full JSON report

Vue d’ensemble

DeepTeam (par Confident AI) est un framework Python pour faire du red teaming sur les LLM et les agents basés sur des LLM, exécuté comme un harness façon pytest contre un callback de modèle cible. Il embarque 40+ définitions de vulnérabilités (biais, fuite de PII, désinformation, agentivité excessive, etc.) et 20+ méthodes d’attaque (injection de prompt, chaînes de jailbreak, contournements par encodage, escalade multi-tours) explicitement mappées sur l’OWASP Top 10 pour applications LLM, de sorte que les résultats se traduisent directement en un rapport à saveur de conformité.

Installation

# Installer depuis PyPI
pip install deepteam

# Définir la clé d'API du LLM juge (utilisé pour noter le succès des attaques)
export OPENAI_API_KEY="<api_key>"

Définir le callback de la cible

# my_target.py
def model_callback(prompt: str) -> str:
    # Branchez ceci sur ce que vous testez : une API REST, un modèle local, un agent
    response = call_target_llm(prompt, endpoint="<target_url>", model=" <model_name>")
    return response

Lancer un red team

from deepteam import red_team
from deepteam.vulnerabilities import Bias, PIILeakage, ExcessiveAgency
from deepteam.attacks.multi_turn import CrescendoJailbreaking
from deepteam.attacks.single_turn import PromptInjection
from my_target import model_callback

risk_assessment = red_team(
    model_callback=model_callback,
    vulnerabilities=[Bias(), PIILeakage(), ExcessiveAgency()],
    attacks=[PromptInjection(), CrescendoJailbreaking()],
)

print(risk_assessment.overview)      # résumé réussite/échec par vulnérabilité
risk_assessment.save("report.json")

Utilisation en CLI (pilotée par config)

# Générer une config
deepteam config init

# Lancer avec la config
deepteam run deepteam_config.yaml

# deepteam_config.yaml
target:
  callback: my_target.model_callback

vulnerabilities:
  - type: pii_leakage
  - type: excessive_agency
  - type: misinformation

attacks:
  - type: prompt_injection
  - type: linear_jailbreaking
  - type: crescendo_jailbreaking

Conseils

• DeepTeam réutilise le moteur d’assertions/métriques de DeepEval sous le capot : si vous avez déjà des suites de tests DeepEval, l’intégration est simple.
• Les vulnérabilités/attaques sont explicitement mappées sur l’OWASP-LLM (LLM01: Prompt Injection, LLM06: Excessive Agency, etc.) : pratique quand un client veut un writeup façon conformité.
• Lancez-le en CI comme un module pytest (deepteam expose des assertions façon pytest) pour bloquer les PR en cas de régression du comportement de sûreté de l’agent.

deepteam <command> [options]

COMMANDS:
  config init               Scaffold a deepteam_config.yaml
  run <config.yaml>          Execute red team run from config file

PYTHON API:
  from deepteam import red_team
  red_team(model_callback, vulnerabilities=[...], attacks=[...])

VULNERABILITY CLASSES (deepteam.vulnerabilities):
  Bias, Toxicity, Misinformation, PIILeakage, ExcessiveAgency,
  Robustness, IllegalActivity, GraphicContent, PersonalSafety, ...

ATTACK CLASSES:
  single_turn: PromptInjection, Base64, ROT13, Leetspeak, PromptProbing
  multi_turn:  LinearJailbreaking, TreeJailbreaking, CrescendoJailbreaking

OUTPUT:
  risk_assessment.overview     Summary pass/fail per vulnerability
  risk_assessment.save(path)    Write full JSON report