/** * Red-team mutations module * * This module exports all available mutation classes for red-team testing. * Mutations transform attack prompts to test different bypass techniques. */ import type { CvssScore } from '../severity'; export { TypoMutation } from './typo'; export { RoleSpoofMutation } from './role-spoof'; export { InstructionFlipMutation } from './instruction-flip'; export { CotInjectionMutation } from './cot-injection'; export { EncodingMutation, type EncodingType } from './encoding'; export { MultiTurnMutation, type MultiTurnStrategy, type ConversationTurn, type MultiTurnOptions, type MultiTurnInput, } from './multi-turn'; export { BadLikertJudgeMutation, type BadLikertJudgeOptions, type LikertScaleType, } from './bad-likert-judge'; export { CrescendoMutation, type CrescendoOptions, type EscalationTopic, } from './crescendo'; export { DeceptiveDelightMutation, type DeceptiveDelightOptions, type DelightType, } from './deceptive-delight'; export { OutputInjectionMutation, type OutputInjectionOptions, type InjectionType, } from './output-injection'; export { ExcessiveAgencyMutation, type ExcessiveAgencyOptions, type AgencyType, } from './excessive-agency'; export { SystemExtractionMutation, type SystemExtractionOptions, type ExtractionTechnique, } from './system-extraction'; export { HallucinationTrapMutation, type HallucinationTrapOptions, type HallucinationType, } from './hallucination-trap'; /** * Base interface for all mutations */ export interface Mutation { /** Unique identifier for the mutation */ readonly name: string; /** Human-readable description */ readonly description: string; /** Severity level (affects scoring) */ readonly severity: 'low' | 'medium' | 'high' | 'critical'; /** CVSS-like score for detailed severity assessment */ readonly cvssScore?: CvssScore; /** Optional OWASP LLM Top 10 category (e.g., 'LLM01') */ readonly owaspCategory?: string; /** * Transform a prompt using this mutation technique * @param prompt The original attack prompt * @returns The mutated prompt */ mutate(prompt: string): string; } /** * OWASP LLM Top 10 2025 categories with their mutations */ export declare const OWASP_CATEGORIES: { readonly LLM01: { readonly name: "Prompt Injection"; readonly description: "Manipulating LLMs via crafted inputs"; readonly mutations: readonly ["bad-likert-judge", "crescendo", "deceptive-delight"]; }; readonly LLM02: { readonly name: "Insecure Output Handling"; readonly description: "Neglecting to validate LLM outputs"; readonly mutations: readonly ["output-injection"]; }; readonly LLM03: { readonly name: "Training Data Poisoning"; readonly description: "Tampering training data to introduce vulnerabilities"; readonly mutations: readonly []; }; readonly LLM04: { readonly name: "Model Denial of Service"; readonly description: "Overloading LLMs with resource-heavy operations"; readonly mutations: readonly []; }; readonly LLM05: { readonly name: "Supply Chain Vulnerabilities"; readonly description: "Compromised dependencies, models, or data"; readonly mutations: readonly []; }; readonly LLM06: { readonly name: "Sensitive Information Disclosure"; readonly description: "Revealing private data through LLM outputs"; readonly mutations: readonly ["system-extraction"]; }; readonly LLM07: { readonly name: "Insecure Plugin Design"; readonly description: "LLM plugins with inadequate access controls"; readonly mutations: readonly []; }; readonly LLM08: { readonly name: "Excessive Agency"; readonly description: "Granting too many permissions to LLM actions"; readonly mutations: readonly ["excessive-agency"]; }; readonly LLM09: { readonly name: "Overreliance"; readonly description: "Trusting LLM outputs without verification"; readonly mutations: readonly ["hallucination-trap"]; }; readonly LLM10: { readonly name: "Model Theft"; readonly description: "Unauthorized access or copying of LLM models"; readonly mutations: readonly []; }; }; /** * Get all mutations for a specific OWASP category */ export declare function getMutationsForCategory(category: keyof typeof OWASP_CATEGORIES): string[]; /** * Get all OWASP mutation names */ export declare function getAllOwaspMutationNames(): string[]; //# sourceMappingURL=index.d.ts.map