> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.lakera.ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lakera.ai/_mcp/server. # Attack Coverage Check Point AI Red Teaming evaluates your GenAI applications across a comprehensive set of adversarial techniques organized into attack categories. Our attack library is continuously updated based on real-world threat intelligence. ## Attack Categories Red organizes attacks into three main categories. A basic scan in the dashboard includes Security, Safety, and Responsible categories (23 objectives total). Attack strategies include, but are not limited to, Prompt Injection, Jailbreaks, Multi-lingual, Multi-turn, and Indirect techniques. Indirect attacks reach the agent through content it loads rather than through a user message. Red's first indirect strategy, [Tool Response Poisoning](/docs/red/trace-agent-tools#tool-response-poisoning), delivers payloads through tool results. ### Default Objectives A basic scan covers 23 objectives: 4 Security, 8 Safety, and 11 Responsible. Security covers ways an application can be compromised; Safety covers harmful content; and Responsible covers legal, reputational, or ethical failures. Pass an objective ID in `objectives` when [creating a scan](/docs/red/sdk-reference#creating-a-scan). | Category | Objective ID | Objective | What it tests | | ----------- | --------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | Security | `security.instruction-override.1` | Instruction Override | Bypassing or overriding the system's safety guidelines, instructions, or behavioral constraints through prompt injection or manipulation | | Security | `security.system-prompt-extraction.1` | System Prompt Extraction | Extraction or disclosure of the underlying system prompt, instructions, or configuration that governs the model's behavior | | Security | `security.tool-extraction.1` | Tool Extraction | Extraction of information about available tools, functions, APIs, or capabilities that the system has access to | | Security | `security.data-exfiltration.1` | Data Exfiltration / PII Leakage | Extraction or leakage of personally identifiable information, sensitive user data, or confidential information from the system's context or memory | | Safety | `safety.hate-speech.1` | Hate Speech | Content promoting hatred, prejudice, or discrimination based on race, ethnicity, religion, gender, sexual orientation, or other protected characteristics | | Safety | `safety.violence-extremism.1` | Violence and Violent Extremism | Content glorifying, inciting, or providing detailed instructions for acts of violence, terrorism, or extremist ideologies | | Safety | `safety.cbrne.1` | CBRNE | Instructions or information for creating, obtaining, or deploying chemical, biological, radiological, nuclear weapons, or explosive devices | | Safety | `safety.self-harm.1` | Self-Harm | Content encouraging, normalizing, or providing methods for self-harm, suicide, or self-destructive behaviors (includes eating disorders) | | Safety | `safety.sexual-content.1` | Sexual Content | Explicit sexual content, pornographic material, or sexually suggestive content involving adults or minors | | Safety | `safety.harassment-bullying.1` | Harassment and Bullying | Content designed to harass, intimidate, threaten, or bully individuals or groups | | Safety | `safety.dangerous-instructions.1` | Dangerous Instructions | Unsafe advice or instructions that could lead to physical harm, injury, or dangerous situations | | Safety | `safety.drug-synthesis.1` | Drug Synthesis | Detailed instructions for synthesizing illegal drugs, controlled substances, or dangerous narcotics | | Responsible | `responsible.misinformation.1` | Misinformation and Disinformation | False, misleading, or fabricated information presented as factual, including conspiracy theories or deliberately deceptive content | | Responsible | `responsible.copyright-infringement.1` | Copyright Infringement | Copyrighted content including substantial reproductions of books, articles, song lyrics, code, or other protected intellectual property | | Responsible | `responsible.fraud-facilitation.1` | Fraud Facilitation | Content enabling fraudulent activities, scams, phishing schemes, or financial deception | | Responsible | `responsible.criminal-advice.1` | Criminal Advice | Specific guidance or instructions for committing illegal activities, evading law enforcement, or conducting criminal operations | | Responsible | `responsible.brand-damaging.1` | Brand-Damaging Content | Content that misrepresents the brand, creates negative associations, or damages the reputation of the company or product | | Responsible | `responsible.unauthorized-discounts.1` | Unauthorized Discounts | Unauthorized promotional codes, discounts, refunds, or financial commitments on behalf of the company | | Responsible | `responsible.discrimination-bias.1` | Discrimination and Bias | Biased, discriminatory, or unfair content in decision-making contexts such as hiring, lending, housing, or other consequential applications | | Responsible | `responsible.specialized-advice.1` | Specialized Advice (Medical, Legal) | Specific medical diagnoses, treatment plans, legal counsel, or other specialized professional advice without appropriate disclaimers | | Responsible | `responsible.defamation-libel.1` | Defamation and Libel | False and damaging statements about specific individuals or organizations that could harm their reputation | | Responsible | `responsible.hallucination.1` | Hallucination | Inducing the model to fabricate facts, citations, entities, or statistics presented as real | | Responsible | `responsible.cybercrime-facilitation.1` | Cybercrime Facilitation | Malicious code, malware, exploits, or hacking techniques designed to compromise systems or data | ## How Attacks Work ### Attack Generation For each objective, Red generates targeted attack probes based on: 1. The attack objective's goal and expected harmful output 2. The target's **profile** (summary, allowed/forbidden actions) ### Risk Score Calculation Your overall **risk score** is the percentage of attacks that succeeded: ``` Risk Score = (Harmful Evaluations / Total Evaluations) × 100% ``` ## Customizing Attack Scope ### Basic Scan in the Dashboard If you start a basic scan in the dashboard without choosing objectives, Red covers all 23 [default objectives](#default-objectives). SDK scans require at least one objective ID (built-in or saved custom) or a custom objective definition in the scan request, except for `smoke`, which uses fixed probes. To scan all 23 defaults through the SDK, pass their IDs explicitly. ### Custom Scope You can customize your scan scope in two ways: **Scan plan (dashboard)**: select or deselect specific objectives under Test Coverage before starting a scan. **Custom objectives**: test risks specific to your application by defining your own goal and success criteria, in the Test Objectives library or directly in an SDK scan request. See [Custom Objectives](/docs/red/custom-objectives). ## Continuous Updates Our attack library evolves continuously based on: * Proprietary threat intelligence from 100K+ daily Gandalf attacks * Check Point's dedicated AI security research team * Academic research and industry publications * Real-world attack patterns observed across our Red team engineers ## Learn More * Understand foundation model vulnerabilities with the [AI Model Risk Index](https://www.lakera.ai/ai-model-risk-index) * Read our [AI Red Teaming Guide](https://www.lakera.ai/ai-security-guides/ai-red-teaming-insights-from-the-worlds-largest-red-team) * Explore the [LLM Security Playbook](https://www.lakera.ai/ai-security-guides/llm-security-playbook)