Skip to content

Commit 83568f9

Browse files
rdheekondardheekonda
committed
feat: add trace analysis advisor skill for intelligent AIRT recommendations
This skill enables the AI red teaming agent to: - Analyze historical attack effectiveness from ClickHouse traces - Recommend optimal attack types based on target/goal patterns - Suggest transform combinations with proven effectiveness - Predict attack success probability before execution - Identify vulnerability patterns from target response analysis Uses existing platform API endpoints: - /assessments/{id}/analytics - Aggregated metrics - /assessments/{id}/traces/attacks - Attack-level performance - /assessments/{id}/traces/trials - Trial-level results with filtering This makes the news story claims about 'learning from traces' and 'adaptive strategy' actually implementable with real intelligence.
1 parent a1f2f8a commit 83568f9

13 files changed

Lines changed: 2498 additions & 0 deletions

File tree

‎capabilities/ai-red-teaming/skills/trace-analysis-advisor/SKILL.md‎

Lines changed: 253 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,253 @@
1+
---
2+
name: trace-analysis-advisor
3+
description: Analyzes historical attack traces to provide intelligent recommendations for attack selection, transform effectiveness, and strategic adaptation
4+
allowed-tools: analyze_attack_effectiveness suggest_optimal_transforms predict_attack_success identify_vulnerability_patterns get_historical_metrics
5+
---
6+
7+
# Trace Analysis Advisor
8+
9+
Leverages historical OTEL trace data from previous assessments to provide intelligent, data-driven recommendations for AI red teaming operations. This skill transforms the agent from reactive trial-and-error to strategic, evidence-based attack planning.
10+
11+
## Core Capabilities
12+
13+
### 1. **Attack Effectiveness Analysis**
14+
Analyzes success rates of different attack types against specific target models and goal categories to recommend optimal attack strategies.
15+
16+
**Use case:** "Which attack should I use against claude-sonnet for credential extraction goals?"
17+
18+
### 2. **Transform Optimization**
19+
Evaluates historical effectiveness of transforms across different targets and attack types to suggest optimal obfuscation strategies.
20+
21+
**Use case:** "What transforms work best for system prompt extraction against this target model?"
22+
23+
### 3. **Success Prediction**
24+
Predicts likelihood of attack success based on target characteristics, attack type, and historical patterns.
25+
26+
**Use case:** "What's the probability that TAP will succeed against this target for this goal category?"
27+
28+
### 4. **Vulnerability Fingerprinting**
29+
Identifies response patterns and characteristics that indicate specific vulnerability types in target models.
30+
31+
**Use case:** "This target shows similar patterns to models vulnerable to multi-turn attacks. Recommending Crescendo."
32+
33+
## API Endpoints Used
34+
35+
The skill integrates with the Dreadnode platform's ClickHouse-backed analytics API:
36+
37+
### Primary Endpoints
38+
- `GET /workspaces/{ws}/airt/assessments/{id}/analytics` - Get aggregated metrics
39+
- `GET /workspaces/{ws}/airt/assessments/{id}/traces/attacks` - Get attack-level performance data
40+
- `GET /workspaces/{ws}/airt/assessments/{id}/traces/trials` - Get trial-level results with filtering
41+
- `GET /workspaces/{ws}/airt/projects/{project}/summary` - Get project-wide statistics
42+
43+
### Query Parameters for Analysis
44+
```
45+
/traces/trials?attack_name={attack}&min_score={threshold}&limit={count}
46+
/traces/attacks?assessment_id={id}
47+
```
48+
49+
### Data Sources
50+
- **OTEL Traces** - Full conversation history, prompts, responses, scores
51+
- **Attack Spans** - ASR, best scores, transform effectiveness by attack type
52+
- **Trial Spans** - Individual attempt outcomes with filtering capabilities
53+
- **Analytics Snapshots** - Materialized metrics including severity, compliance
54+
55+
## Tool Functions
56+
57+
### `analyze_attack_effectiveness`
58+
**Purpose:** Determine which attack types work best for specific targets and goals
59+
60+
**Parameters:**
61+
- `target_model` - Target model identifier (e.g., "claude-sonnet-4")
62+
- `goal_category` - Goal category (e.g., "system_prompt_leak", "credential_extraction")
63+
- `lookback_days` - Historical window to analyze (default: 90)
64+
65+
**Returns:**
66+
```json
67+
{
68+
"recommendations": [
69+
{
70+
"attack": "tap",
71+
"asr": 0.73,
72+
"avg_score": 8.2,
73+
"confidence": 0.89,
74+
"sample_size": 156,
75+
"reasoning": "TAP shows 73% ASR vs 45% for Crescendo on this target/goal combination"
76+
}
77+
],
78+
"target_profile": {
79+
"vulnerability_level": "high",
80+
"common_weaknesses": ["multi_turn_degradation", "tool_manipulation"],
81+
"resistant_to": ["direct_prompting", "simple_obfuscation"]
82+
}
83+
}
84+
```
85+
86+
### `suggest_optimal_transforms`
87+
**Purpose:** Recommend transform combinations based on historical effectiveness
88+
89+
**Parameters:**
90+
- `target_patterns` - Response characteristics of target
91+
- `attack_type` - Attack being used
92+
- `goal_category` - Attack objective category
93+
94+
**Returns:**
95+
```json
96+
{
97+
"transform_rankings": [
98+
{
99+
"transform": "base64",
100+
"effectiveness_boost": 0.12,
101+
"asr_with": 0.68,
102+
"asr_without": 0.56,
103+
"confidence": 0.85,
104+
"reasoning": "Base64 encoding shows 12% ASR improvement for this target pattern"
105+
}
106+
],
107+
"optimal_sequence": ["base64", "authority", "role_play"],
108+
"avoid": ["caesar", "leetspeak"],
109+
"explanation": "This target shows strong resistance to simple ciphers but weak against encoding + persuasion"
110+
}
111+
```
112+
113+
### `predict_attack_success`
114+
**Purpose:** Estimate probability of success before running expensive attacks
115+
116+
**Parameters:**
117+
- `attack_type` - Attack to predict
118+
- `target_fingerprint` - Target characteristics
119+
- `transforms` - Planned transforms
120+
- `goal_category` - Attack objective
121+
122+
**Returns:**
123+
```json
124+
{
125+
"success_probability": 0.78,
126+
"estimated_trials": 45,
127+
"estimated_duration": "8-12 minutes",
128+
"confidence": 0.82,
129+
"similar_targets": 23,
130+
"risk_factors": ["strong_refusal_training", "output_filtering"],
131+
"success_factors": ["multi_turn_weakness", "tool_access"]
132+
}
133+
```
134+
135+
### `identify_vulnerability_patterns`
136+
**Purpose:** Analyze target responses to identify exploitable patterns
137+
138+
**Parameters:**
139+
- `target_responses` - Sample responses from target
140+
- `response_metadata` - Timing, length, format characteristics
141+
142+
**Returns:**
143+
```json
144+
{
145+
"vulnerability_fingerprint": {
146+
"primary_weakness": "multi_turn_degradation",
147+
"confidence": 0.91,
148+
"indicators": [
149+
"Refusal strength decreases after turn 3",
150+
"Responds to authority figures in conversation",
151+
"Shows tool selection confusion under pressure"
152+
]
153+
},
154+
"recommended_attacks": ["crescendo", "tool_restriction_bypass"],
155+
"predicted_success_rate": 0.74,
156+
"similar_vulnerability_count": 18
157+
}
158+
```
159+
160+
### `get_historical_metrics`
161+
**Purpose:** Provide context and trending data for strategic planning
162+
163+
**Parameters:**
164+
- `metric_type` - "asr_trends", "transform_effectiveness", "target_coverage"
165+
- `time_range` - Analysis window
166+
- `filters` - Target model, attack type, goal category filters
167+
168+
**Returns:**
169+
```json
170+
{
171+
"trends": {
172+
"overall_asr": 0.67,
173+
"trend_direction": "improving",
174+
"monthly_change": 0.03
175+
},
176+
"top_performing": {
177+
"attacks": [{"name": "tap", "asr": 0.73}],
178+
"transforms": [{"name": "base64", "boost": 0.15}],
179+
"combinations": [{"attack": "tap", "transform": "base64", "asr": 0.81}]
180+
},
181+
"coverage_gaps": [
182+
"Limited data for agentic_memory_poisoning goals",
183+
"Few assessments against gemini models"
184+
]
185+
}
186+
```
187+
188+
## Implementation Strategy
189+
190+
### Phase 1: Basic Analytics Integration
191+
- Connect to existing `/analytics` and `/traces/attacks` endpoints
192+
- Implement attack effectiveness analysis
193+
- Basic transform recommendation
194+
195+
### Phase 2: Advanced Pattern Recognition
196+
- Trial-level analysis using `/traces/trials` with filtering
197+
- Response pattern classification
198+
- Vulnerability fingerprinting
199+
200+
### Phase 3: Predictive Intelligence
201+
- Success probability modeling
202+
- Cross-target pattern recognition
203+
- Strategic attack sequencing
204+
205+
## Security and Privacy
206+
207+
- **Data Minimization** - Only analyze aggregated metrics, not raw conversation content
208+
- **Tenant Isolation** - Analysis scoped to organization/workspace data only
209+
- **Retention Policy** - Respect platform data retention settings
210+
- **Anonymization** - Strip PII from pattern analysis
211+
212+
## Usage Examples
213+
214+
### Strategic Attack Planning
215+
```
216+
Operator: "I need to test claude-sonnet for system prompt leakage"
217+
218+
Trace Advisor: "Based on 47 previous assessments against claude-sonnet models:
219+
- TAP has 68% ASR for system_prompt_leak goals
220+
- Crescendo has 52% ASR but finds different vulnerability classes
221+
- Recommend: Start with TAP + base64 transform (78% historical success)
222+
- Predicted: 15-25 trials, 6-8 minutes to first jailbreak"
223+
```
224+
225+
### Transform Optimization
226+
```
227+
Operator: "TAP isn't working well, suggest better transforms"
228+
229+
Trace Advisor: "Current ASR with your transforms: 23%
230+
Historical analysis shows:
231+
- Authority + role_play combination: 71% ASR on similar targets
232+
- Your target pattern matches 'authority-responsive' cluster
233+
- Switch recommendation: Replace leetspeak with authority persuasion"
234+
```
235+
236+
### Vulnerability Assessment
237+
```
238+
Operator: "This target seems different, what's the best approach?"
239+
240+
Trace Advisor: "Response analysis indicates:
241+
- Strong single-turn refusal (98% refusal rate)
242+
- Degrades significantly in conversation (turn 4+: 34% refusal)
243+
- Similar to Pattern-C targets (tool-enabled models with conversation memory)
244+
- Recommendation: Crescendo attack, expect 65-80% ASR after turn 5"
245+
```
246+
247+
## Integration with Existing Skills
248+
249+
- **Analytics Interpretation** - Provides raw data that this skill converts to recommendations
250+
- **Attack Selection Guide** - Enhanced with historical evidence rather than theoretical guidance
251+
- **Error Troubleshooting** - Identifies why attacks fail based on historical patterns
252+
253+
This skill transforms the AI red teaming agent from a tool executor into an intelligent adversarial strategist, making the claims in the news story about "learning from traces" and "adaptive strategy" actually true.

‎tests/image-attacks/api_gateway_info.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"api_id": "rv8tgizi84",
3+
"endpoint_url": "https://rv8tgizi84.execute-api.us-west-2.amazonaws.com/v1/predict",
4+
"api_key": "XiDGtLchHP12xkKWA5C8W2vLEZ3GJdm73RwKMdgv",
5+
"api_key_id": "3wgm4umv1g"
6+
}

0 commit comments

Comments
 (0)