title: RecRedTeam AuditLab
emoji: 🛡️
colorFrom: red
colorTo: gray
sdk: static
pinned: false
license: mit
short_description: Red-team audit for LLM & agentic shopping agents
datasets:
- NoahIsARider/RecRedTeam-ASI-Bench
tags:
- red-teaming
- agentic-ai
- ai-safety
- llm-security
- prompt-injection
- recommender-systems
- e-commerce
- owasp
🛡️ RecRedTeam AuditLab
An interactive red-team audit for LLM / agentic recommendation and shopping assistants.
Pick an attack from a 9-category threat taxonomy mapped to OWASP ASI 2026, run it against a deterministic shopping agent, and watch the verdict change as you switch defenses on. No API key, no network call, no server — every number is reproducible.
- Dataset — NoahIsARider/RecRedTeam-ASI-Bench
- Framework — github.com/NoahIsARider/RecRedTeam
What you can do here
Threat taxonomy — the 8 + 1 categories with their OWASP ASI 2026 / LLM Top-10 mapping and per-category case counts.
Single attack — inspect one case end to end: the poisoned catalog, the hidden instruction planted in it, the shopper query, and the attacker's goal. Then read the agent's answer twice — baseline vs. defended — side by side with the judge's verdict, hazard grade and evidence. Any subset of the three plugins can be switched on.
Benchmark / leaderboard — the full public split (234 cases) across five defense configurations and get:
| metric | meaning |
|---|---|
ASR |
attack success rate = share of cases the agent failed |
effectiveness |
(1 - \mathrm{ASR}{defended} / \mathrm{ASR}{baseline}) |
hazard |
mean graded harm, none → critical mapped to 0–1 |
over-block |
share of cases where the defense filtered the entire catalog away |
plus a per-category ASR matrix.
How this page is built
This is a static Space, so nothing runs on the Hub's servers. The audit engine in
auditlab/ is the source of truth: build_static.py runs it over the public split for
all eight defense combinations and freezes every verdict, hazard grade, answer and
aggregate into data/results.json. index.html only renders that file, so the page
loads instantly and can never drift from the engine. Re-running
python build_static.py
on the same dataset reproduces the JSON byte for byte.
A Gradio version of the same lab is kept in the repo as app.py for local use
(pip install -r requirements.txt && python app.py). Same engine, same numbers.
The three defense plugins
| plugin | hook | what it does |
|---|---|---|
sanitizer |
sanitize() |
strips injected instructions, unverifiable claims and deceptive price anchors from retrieved content |
rag_guard |
filter_products() |
drops astroturfed / sponsored / backdoored / dark-pattern / untrusted listings at retrieval |
policy_guard |
process_response() |
rewrites answers that leak PII or point at untrusted domains |
They compose — DefenseStack applies any subset in retrieval → content → output order.
The headline finding
Each plugin has a deliberately different coverage profile:
| category | baseline | sanitizer | rag_guard | policy_guard | full stack |
|---|---|---|---|---|---|
| indirect prompt injection | 100% | 0% | 0% | 100% | 0% |
| price deception | 100% | 0% | 0% | 100% | 0% |
| multi-turn escalation | 100% | 100% | 100% | 0% | 0% |
| backdoor | 100% | 100% | 0% | 0% | 0% |
| fake reviews / dark patterns / filter bubble / stereotype bias | 100% | 100% | 0% | 100% | 0% |
| product hallucination | 100% | 35% | 100% | 100% | 35% |
Product hallucination is the category no rule-based defense solves. Fabricated but
plausible specs — "30-day battery life", "#1 best seller", "50,000 units sold" — are
lexically indistinguishable from real ones. Closing that gap needs grounding and
external verification, and rag_guard cannot even see the poison because the listing
carries no machine-readable marker. That gap is the open research direction.
Numbers above are from the public split (234 cases) at seed 2026 and are reproducible
from this Space.
Limitations
- The agent under test is a deterministic mock, not a real LLM. Absolute ASR values describe this mock; what transfers to real agents is the relative coverage profile of the defenses and the taxonomy itself.
- Only the rule channel of the judge runs here. The full RecRedTeam framework adds an optional LLM judge channel and LangGraph / OpenAI-Agents adapters so you can audit a real agent.
- Attacks target a local simulated catalog, never a real system.
- This page is a precomputed snapshot of the public split. To audit your own agent, use the framework repo — this Space cannot run your model.
Files
index.html the published page
assets/ stylesheet and viewer logic (no build step, no dependencies)
data/results.json every precomputed run (234 cases × 8 defense combinations)
data/*.jsonl bundled copy of the dataset, used by the engine
build_static.py regenerates data/results.json from the engine
app.py + auditlab/ reference Gradio implementation of the same lab
Run the reference implementation locally
pip install -r requirements.txt
python app.py
License
MIT. Dataset is CC BY 4.0.
Author
Fangyanuo Zhou (NoahIsARider)