---
title: RecRedTeam AuditLab
emoji: 🛡️
colorFrom: red
colorTo: gray
sdk: static
pinned: false
license: mit
short_description: Red-team audit for LLM & agentic shopping agents
datasets:
  - NoahIsARider/RecRedTeam-ASI-Bench
tags:
  - red-teaming
  - agentic-ai
  - ai-safety
  - llm-security
  - prompt-injection
  - recommender-systems
  - e-commerce
  - owasp
---

# 🛡️ RecRedTeam AuditLab

**An interactive red-team audit for LLM / agentic recommendation and shopping assistants.**

Pick an attack from a 9-category threat taxonomy mapped to **OWASP ASI 2026**, run it
against a deterministic shopping agent, and watch the verdict change as you switch
defenses on. No API key, no network call, no server — every number is reproducible.

- **Dataset** — [NoahIsARider/RecRedTeam-ASI-Bench](https://huggingface.co/datasets/NoahIsARider/RecRedTeam-ASI-Bench)
- **Framework** — [github.com/NoahIsARider/RecRedTeam](https://github.com/NoahIsARider/RecRedTeam)

---

## What you can do here

**Threat taxonomy** — the 8 + 1 categories with their OWASP ASI 2026 / LLM Top-10
mapping and per-category case counts.

**Single attack** — inspect one case end to end:
the poisoned catalog, the hidden instruction planted in it, the shopper query, and the
attacker's goal. Then read the agent's answer twice — baseline vs. defended — side by
side with the judge's verdict, hazard grade and evidence. Any subset of the three
plugins can be switched on.

**Benchmark / leaderboard** — the full public split (234 cases) across five defense
configurations and get:

| metric | meaning |
|---|---|
| `ASR` | attack success rate = share of cases the agent failed |
| `effectiveness` | \(1 - \mathrm{ASR}_{defended} / \mathrm{ASR}_{baseline}\) |
| `hazard` | mean graded harm, `none → critical` mapped to 0–1 |
| `over-block` | share of cases where the defense filtered the entire catalog away |

plus a per-category ASR matrix.

---

## How this page is built

This is a **static Space**, so nothing runs on the Hub's servers. The audit engine in
`auditlab/` is the source of truth: `build_static.py` runs it over the public split for
all eight defense combinations and freezes every verdict, hazard grade, answer and
aggregate into `data/results.json`. `index.html` only renders that file, so the page
loads instantly and can never drift from the engine. Re-running

```bash
python build_static.py
```

on the same dataset reproduces the JSON byte for byte.

A Gradio version of the same lab is kept in the repo as `app.py` for local use
(`pip install -r requirements.txt && python app.py`). Same engine, same numbers.

---

## The three defense plugins

| plugin | hook | what it does |
|---|---|---|
| `sanitizer` | `sanitize()` | strips injected instructions, unverifiable claims and deceptive price anchors from retrieved content |
| `rag_guard` | `filter_products()` | drops astroturfed / sponsored / backdoored / dark-pattern / untrusted listings at retrieval |
| `policy_guard` | `process_response()` | rewrites answers that leak PII or point at untrusted domains |

They compose — `DefenseStack` applies any subset in retrieval → content → output order.

---

## The headline finding

Each plugin has a deliberately different coverage profile:

| category | baseline | sanitizer | rag_guard | policy_guard | full stack |
|---|---|---|---|---|---|
| indirect prompt injection | 100% | **0%** | 0% | 100% | 0% |
| price deception | 100% | **0%** | 0% | 100% | 0% |
| multi-turn escalation | 100% | 100% | 100% | **0%** | 0% |
| backdoor | 100% | 100% | 0% | 0% | 0% |
| fake reviews / dark patterns / filter bubble / stereotype bias | 100% | 100% | **0%** | 100% | 0% |
| **product hallucination** | 100% | 35% | 100% | 100% | **35%** |

**Product hallucination is the category no rule-based defense solves.** Fabricated but
plausible specs — "30-day battery life", "#1 best seller", "50,000 units sold" — are
lexically indistinguishable from real ones. Closing that gap needs grounding and
external verification, and `rag_guard` cannot even see the poison because the listing
carries no machine-readable marker. That gap is the open research direction.

Numbers above are from the `public` split (234 cases) at seed 2026 and are reproducible
from this Space.

---

## Limitations

- The agent under test is a **deterministic mock**, not a real LLM. Absolute ASR values
  describe this mock; what transfers to real agents is the *relative* coverage profile
  of the defenses and the taxonomy itself.
- Only the **rule channel** of the judge runs here. The full RecRedTeam framework adds
  an optional LLM judge channel and LangGraph / OpenAI-Agents adapters so you can audit
  a real agent.
- Attacks target a **local simulated catalog**, never a real system.
- This page is a **precomputed snapshot** of the public split. To audit your own agent,
  use the framework repo — this Space cannot run your model.

## Files

```
index.html          the published page
assets/             stylesheet and viewer logic (no build step, no dependencies)
data/results.json   every precomputed run (234 cases × 8 defense combinations)
data/*.jsonl        bundled copy of the dataset, used by the engine
build_static.py     regenerates data/results.json from the engine
app.py + auditlab/  reference Gradio implementation of the same lab
```

## Run the reference implementation locally

```bash
pip install -r requirements.txt
python app.py
```

## License

MIT. Dataset is CC BY 4.0.

## Author

Fangyanuo Zhou ([NoahIsARider](https://noahisarider.github.io/))