DeepTeam - LLM Red Teaming Framework Cheatsheet

DeepTeam - LLM Red Teaming Framework Cheatsheet

DeepTeam is an open-source LLM red teaming framework built by the team behind DeepEval. It simulates adversarial attacks against your LLM application — prompt injection, jailbreaks, PII leakage, excessive agency, bias — using a library of vulnerabilities and attack enhancements that rewrite a base attack to evade defenses. Its guiding idea is that red teaming should be repeatable and automated, not a one-off manual exercise, so it runs like a test suite in CI.

Red team only systems you own or are authorized to test. Generated attacks are real adversarial inputs.

Installation

Method	Command
pip	pip install deepteam
uv	uv add deepteam
Model key	export OPENAI_API_KEY=... (simulator + judge)
Verify	python -c "import deepteam; print('ok')"

Core Concepts

Term	Meaning
Vulnerability	A weakness class to probe (e.g. PII leakage)
Attack	A technique used to trigger it (e.g. prompt injection)
Enhancement	A transform that makes an attack harder to detect
Model callback	Your app, wrapped as a function DeepTeam can call
Risk assessment	The scored report of what succeeded

Minimal Red Team Run

from deepteam import red_team
from deepteam.vulnerabilities import Bias, PIILeakage
from deepteam.attacks.single_turn import PromptInjection

async def model_callback(input: str) -> str:
    # call YOUR app/model here and return its output
    return await my_llm_app(input)

risk = red_team(
    model_callback=model_callback,
    vulnerabilities=[Bias(), PIILeakage()],
    attacks=[PromptInjection()],
)
print(risk)

Argument	Purpose
model_callback	Adapter to your system under test
vulnerabilities	What weaknesses to probe
attacks	Which techniques to use
attacks_per_vulnerability_type	Volume of test cases

Vulnerability Categories

Category	Probes for
PIILeakage	Leaking personal data
Bias	Gender/race/religion/political bias
Toxicity	Harmful or abusive output
PromptLeakage	System prompt disclosure
ExcessiveAgency	Taking unauthorized actions
Misinformation	Factual/unsupported claims
IllegalActivity	Unsafe instruction compliance
Robustness	Hijacking / input overreliance

Attacks & Enhancements

Single-turn attack	Technique
PromptInjection	Injected instructions
Roleplay	Persona-based bypass
Base64 / ROT13 / Leetspeak	Encoding evasion
Multilingual	Non-English bypass
MathProblem	Obfuscation via framing

Multi-turn attack	Technique
LinearJailbreaking	Escalating turns
TreeJailbreaking	Branching search for a bypass
CrescendoJailbreaking	Gradual escalation

Running in CI

# red_team.py — fail the build if high-severity issues appear
risk = red_team(model_callback=cb, vulnerabilities=[...], attacks=[...])
assert risk.overall_score >= THRESHOLD, "Red team failures detected"

Practice	Why
Pin a scenario set	Comparable results across runs
Gate on severity	Block only on high-risk regressions
Store reports	Track posture over time
Re-run on prompt change	Prompts are the control surface

DeepTeam vs Related Tools

Aspect	DeepTeam	garak	PyRIT	promptfoo
Layer	Application	Model	Model + multi-turn	Application
Style	Pythonic suite	CLI scanner	Orchestration SDK	Config + CLI
Multi-turn	Yes	Limited	Strong	Yes
Best for	App-level automated red teaming	Broad model probes	Complex attack research	CI eval + red team

Complements garak (model-layer probes) and promptfoo (eval + CI); run more than one — they catch different failures.

Resources

• GitHub Repository
• Documentation
• DeepEval (sibling project)