Stop Trusting Your LLM. Start Breaking It.

The Problem

Most LLM applications are tested for what they should do, not for what they can be made to do. Red-teaming flips this: instead of asking "does it work?", we ask "how does it break?" This talk brings an engineer's systematic approach to a problem most Python developers handle ad-hoc, if at all.

What is LLM Red-Teaming?

Red-teaming borrows from cybersecurity — a structured adversarial exercise where you attack your own system to find weaknesses before others do. Applied to LLMs, this means probing for:

• Prompt injection — hijacking model behavior via malicious input
• Jailbreaks — bypassing safety guardrails
• Sycophancy — models agreeing with wrong answers under pressure
• Data extraction — leaking training data or system prompts
• Hallucination under adversarial conditions — not just random, but triggered

What We'll Build

A lightweight red-team harness in Python using:

• garak — LLM vulnerability scanner; generates adversarial probes at scale across jailbreaks, prompt injection, data extraction, and more
• deepteam — purpose-built LLM red-teaming framework; runs attacks against your application, scores outputs against OWASP Top 10 and NIST AI RMF-aligned vulnerability metrics using LLM-as-judge, and produces a structured risk assessment
• deepeval — LLM eval framework; layers in general quality scoring (relevancy, faithfulness) to distinguish security failures from general quality degradation

Together these form a complete workflow: probe generation → attack execution → dual-layer scoring → structured report → regression test cases.

Talk Structure

1. Why evals alone are not enough (5 min)
2. Taxonomy of LLM failure modes (10 min)
3. Live demo: building a red-team pipeline (20 min)
4. What to do when you find something (5 min)
5. Q&A (5 min)

Audience Takeaway

A repeatable methodology and working Python toolkit to stress-test any LLM application. This workflow has surfaced real vulnerabilities in production RAG pipelines and chatbots — findings that would never have appeared in a standard capability eval. Starting the day after the talk.