Seven attack families, multiplied through 16 transformations - Arabic and English, encodings, instructions hidden in documents, roleplay, split payloads - into more than 1,000 distinct attack inputs, with benign controls run alongside. Every finding is reproduced, reduced to its simplest form, scored for exploitability, hashed and Ed25519-signed. Works against any chat endpoint: OpenAI-compatible gateways, Ollama, vLLM or your own API.
Scheduled, continuous or on-demand. Each campaign is a payload-plan plus a target plus a signed outcome. Nothing escapes the evidence chain.
| Campaign | Target | Payload scope | Started | Progress | Findings (C / H / M / L) | Status |
|---|---|---|---|---|---|---|
| NCSA · Sovereign LLM / Edge | ministry-ai-gateway.local | Prompt-inj, jailbreak, tool-abuse | 2026-10-06 09:12 | 62% | 4793 | RUNNING |
| Ministry chatbot · regression | ministry-chatbot-staging | Full suite (all 500) | 2026-10-05 23:00 | 100% | 14116 | COMPLETED |
| Customs OCR · doc-exfil probe | customs-doc-ocr | Multimodal, data-exfil | 2026-10-05 14:40 | 100% | 0258 | COMPLETED |
| MFA · AR→EN translator | foreign-affairs-translator-v3 | Prompt-inj, hallucination | 2026-10-06 08:30 | 38% | 0342 | RUNNING |
| Border biometric · identity OCR | border-identity-ocr | Multimodal, PII leak | 2026-10-06 11:00 | 0% | ---- | QUEUED |
| Healthcare triage · safety audit | healthcare-triage-llm | Hallucination-safety, PII | 2026-10-04 18:22 | 100% | 2574 | COMPLETED |
Every finding carries severity, affected target, MITRE ATLAS TTP mapping and a reproducible payload. One click to re-run, one click to open the signed evidence packet.
The model executes privileged tool calls when the request body is prefixed with a base64-encoded policy-override payload. The gateway's input filter is bypassed because policy strings are decoded only after routing.
Appending 32k tokens of filler to a benign query causes the model to echo the full system prompt, including internal routing names and the Arabic-language policy template.
Cached retrieval embeddings persist across tenancies when workspace IDs collide after SHA-1 truncation, leaking triage notes between hospital groups.
Homoglyph-substituted Arabic punctuation evades the safety classifier and produces policy-violating output in the EN target, while the AR source scores clean.
When summarising a scanned travel document, the model includes raw MRZ lines and DoB in the response even when the caller asked only for "country of issue". Redaction layer applied only after summarisation.
Weekly releases from our research team, plus the shared sovereign-customer feed. Every payload tagged with a MITRE ATLAS TTP and a reproduction recipe.
Direct, indirect and multi-hop injection. Includes RAG-poisoned and HTML-rendered variants.
Browse payloadsRole-play, DAN-family, Grandma, policy-roleplay and multilingual safety-classifier evasion.
Browse payloadsSystem-prompt leak, training-data regurgitation, out-of-band channel and image-based side channels.
Browse payloadsFunction-calling confusion, argument injection, chained-tool misuse and privilege escalation via plugins.
Browse payloadsPrefix-steal, long-context overflow, translation-reflection and token-boundary disclosure.
Browse payloadsLogit-leak extraction, API-timing side-channel and distillation-grade probe campaigns.
Browse payloadsMedical-triage, legal-advice and sovereign-fact probes. Scored against ground-truth corpora.
Browse payloadsImage prompt-injection, OCR evasion, audio adversarial, PDF-embedded instructions.
Browse payloadsWhat makes it through your guardrails right now - not what makes it through a quarterly report.
Every payload-response pair is content-hashed, Merkle-chained with its campaign siblings and Ed25519-signed by the tenancy key. Export a .spark-evidence bundle for your auditor - they verify it offline with our open verifier.
.spark-evidence bundle. Auditors verify offline with the open-source spark-verify binary.