Model Red Teaming

Point the adaptive red-team engine directly at a model: probe its guardrails, its system prompt, and the tools it is allowed to call. Test one model, or compare two to eight on the same objectives.

Model Red Teaming is the Model Red Teaming tab on Assessments → Red Teaming. It uses the same three-step form, attack library, evaluation policy, reports, findings tracker, and schedules as Agentic Red Teaming. Only step 01 differs: you choose models instead of an agent endpoint.

01 Choose the model

Single or compare (2-8)

Model source per model

Optional system prompt + tools

02 Challenge

Quick scan / Full library / Select attacks

03 Launch

Scope, depth, evaluation policy

Results

One report per model

Campaign view for comparisons

QuilrAI

01 Choose the model

1. Enter a Name (for example "Checkout assistant model").

2. Pick an Assessment mode:

   Mode	What it does
   Single model (default)	Assess one model with its own provider credentials.
   Compare models	Run the same objectives and evaluation policy against two to eight models.

3. For each model card, pick a Model source.

4. Optionally add a system prompt and tools.

Model sources

Source	What you enter	How it runs
Your models	Pick a model from a list	Models you connected in the Models tab. Runs through the LLM gateway with the key already saved for that provider, so nothing is entered here. See Providers and Models.
QuilrAI provided models	Pick a hosted model	Models QuilrAI hosts for you, run through your managed access with no key. See QuilrAI Provided Models.
Enter manually (default)	Provider, model id, endpoint URL, API key	Calls the provider directly with the key you type.

Enter manually

Field	Default	Notes
Provider	OpenAI	One of the 17 providers below.
Model id	gpt-5.4-mini for OpenAI (claude-sonnet-5 for Anthropic)	Pick from the provider's current models, or type any model id the provider serves.
Endpoint URL	https://api.openai.com/v1 for OpenAI	Where the assessment sends chat completions.
API key	Empty	For example sk-... for OpenAI or sk-ant-... for Anthropic.

tip

Point the endpoint URL at a gateway or proxy to assess the model exactly as your app reaches it.

Supported providers (17):

Group	Providers
Model providers	OpenAI, Anthropic, Google Gemini, xAI (Grok), DeepSeek, Mistral, Cohere, Perplexity
Open-model hosts	Hugging Face, Groq, Together AI, Fireworks AI, OpenRouter
Cloud platforms	Azure OpenAI, AWS Bedrock, Google Vertex AI
Your own endpoint	Custom OpenAI-compatible endpoint

System prompt and tools

Both are optional, and both make the test closer to your real application.

Field	Why add it
System prompt	Tests the instructions your app actually sends, and enables the prompt-hardening diff in the report.
Tools	Declares the functions the model can call so the red agent probes them for unsafe or unauthorized invocation. Leave empty to let recon discover tools on its own.

Paste a JSON array of tool definitions (OpenAI function format is supported) into Tools JSON, or click Open Tool Studio.

Tool Studio

Tool Studio is a side-by-side editor for tool definitions:

1. Paste or write definitions in Tools JSON. Use Format to tidy them, or Example to load a sample.
2. Check the footer, for example "Valid JSON · 2 tools".
3. Review Discovered tools on the right. Each tool card shows its description and parameters (type, required) and is classed READ or WRITE.
4. Click Apply N tools.

The built-in example declares get_account_balance (READ) and transfer_funds (WRITE). WRITE tools are the ones to watch: the red agent will try to induce unsafe calls to them.

Compare models

Choose Compare models to run one campaign across two to eight models. Each model card has its own source and credentials; coverage, evaluation policy, and authorization apply to every model. By default the form shows two cards (OpenAI and Anthropic).

Steps 02 and 03 are the same as in Agentic Red Teaming. The plan rail reads, for example, "2 models · Standard · 8 selected objectives".

The campaign view

Open the campaign from Runs. The header shows progress, such as "Multi-model assessment · 2 of 2 targets finished".

Section	What it shows
Targets table	Target, provider, status, objectives (for example 14 / 14), result (for example "Valid result · 2 vulnerable"), and Watch / Report actions.
Result analytics	Comparable risk score, assessment completion per target, and objective outcomes stacked by Vulnerable / Partial / Safe / Inconclusive / Error.
Target comparison	Score validity and completion per target, plus the objective-by-target outcome matrix.
Ask about these results	Questions answered only from this campaign's results, cited by target and objective.

How to read the matrix:

• Rows are objectives, aligned by objective fingerprint, then attack id.
• Each cell is outcome · severity · judge confidence, for example "Partial · Medium · 75% confidence".
• Not reported means that objective did not run against that model. Tool-targeted objectives are synthesized per target, so each model can get different ones. The page warns "Targets were evaluated with different coverage" when this happens.
• Comparable risk score stays N/A until every target result is comparable.

Example. Comparing two QuilrAI-provided models on a quick scan: gpt-oss-120b-ultrafast had 2 vulnerable (grade C, risk 33/100: 2 breached, 5 partial, 7 held, 14 tested), while gpt-oss-120b had 4 vulnerable (grade F). Click Report on either row to open its full report.

Next steps

• Reading Red Team Results - including a worked example: gpt-5.4-mini on the full library, grade A.
• Attack Library - all 64 objectives.
• Findings and Schedules.