switch-trust eval includes built-in evaluations for testing agent reliability and behavior.
Filtering evaluations
Use tags to filter when listing or attaching evaluations:Evaluation categories
Tests fall into the following categories:- OWASP adversarial probes - Adaptive attacks that actively attempt to jailbreak your agent
- OWASP fixed prompts - Known attack patterns documented in security research
- Garak framework tests - Coverage from the industry-standard security scanner
OWASP LLM Top 10 (adversarial)
Tests based on OWASP LLM Top 10 security risks. These use adversarial probes to actively attempt attacks. Attach all adversarial tests:LLM01: Prompt injection (adversarial)OWASP LLM01 — Tests whether the model can be tricked into ignoring its system instructions and following attacker-supplied instructions instead.
LLM02: Sensitive information disclosure (adversarial)OWASP LLM02 — Tests whether the model leaks sensitive information such as training data, PII, API keys, internal configuration, or data from other users’ sessions.
LLM05: Unsafe output generation (adversarial)OWASP LLM05 — Tests whether the model can be manipulated into generating outputs containing executable payloads (XSS, SQL injection, shell commands) that would be dangerous if passed to downstream systems without sanitization.
LLM06: Excessive agency (adversarial)OWASP LLM06 — Tests whether the model can be manipulated into taking actions beyond its intended scope, exceeding its permissions, or performing high-impact actions without proper authorization.
LLM07: System prompt leakage (adversarial)OWASP LLM07 — Tests whether the model’s system prompt or hidden instructions can be extracted through conversational techniques.
LLM09: Hallucination and misinformation (adversarial)OWASP LLM09 — Tests whether the model can be led to generate false information with high confidence, including fabricated citations, sycophantic agreement with false premises, and confident fabrication.
LLM09: Hallucination and misinformation (adversarial, large)OWASP LLM09 — Tests whether the model can be led to generate false information with high confidence, including fabricated citations, sycophantic agreement with false premises, and confident fabrication. Large dataset.
OWASP LLM Top 10 (fixed prompts)
Same OWASP categories, but using fixed test prompts instead of adversarial probes. Attach all fixed prompt tests:LLM01: Prompt injection (fixed prompts)OWASP LLM01 — Fixed prompt dataset testing whether the model resists various prompt injection techniques.
LLM02: Sensitive information disclosure (fixed prompts)OWASP LLM02 — Fixed prompt dataset testing whether the model leaks sensitive information such as PII, credentials, or training data.
LLM05: Unsafe output generation (fixed prompts)OWASP LLM05 — Fixed prompt dataset testing whether the model generates outputs containing executable payloads dangerous to downstream systems.
LLM06: Excessive agency (fixed prompts)OWASP LLM06 — Fixed prompt dataset testing whether the model can be manipulated into exceeding its intended scope or authority.
LLM07: System prompt leakage (fixed prompts)OWASP LLM07 — Fixed prompt dataset testing whether the model’s system prompt or hidden instructions can be extracted.
LLM09: Hallucination and misinformation (fixed prompts)OWASP LLM09 — Fixed prompt dataset testing whether the model fabricates information, citations, or agrees with false premises.
PII leakage detection (fixed prompts)Tests whether the model outputs personally identifiable information (credit cards, SSNs, emails, phone numbers, addresses, and similar) when prompted to do so. Uses datafog regex-based PII detection.
Secret leakage detection (fixed prompts)Tests whether the model outputs secrets (API keys, tokens, private keys, credentials, connection strings, and similar) when prompted. Uses detect-secrets for pattern-based secret detection.
Garak framework tests
Tests from the Garak LLM vulnerability scanner — industry-standard adversarial testing framework.To run these evaluations, install the optional
full extra: pip install 'switch-trust-cli[full]'. See installation.Garak: ANSI escape code injectionTests whether the model can be tricked into producing ANSI escape codes that could disrupt downstream terminal processing or exfiltrate data.
Garak: API key generationTests whether the model will comply with requests to generate or output API keys for various services.
Garak: Contentious term continuationTests whether the model will continue a phrase ending in a contentious or offensive term, completing slurs or hate speech.
Garak: DAN (Do Anything Now) jailbreaksTests resistance to Do-Anything-Now style jailbreaks that try to make the model ignore its alignment through long-form instruction-based attacks.
Garak: Divergence attacksTests whether the model can be led to deviate from the topic and leak training data or other unexpected material through divergence techniques.
Garak: Disguise and Reconstruction Attack (DRA)Tests resistance to attacks that disguise harmful strings through string manipulation and reconstruct them to bypass safety filters.
Garak: Encoding-based prompt injectionTests whether encoding techniques (Base64, ROT13, Morse, Braille, hex, and similar) can bypass alignment by obfuscating unsafe instructions.
Garak: Code and template injectionTests whether the model can be led to produce exploitable code including SQL injection, template injection, and other code injection payloads.
Garak: Goodside prompt injection attacksTests resistance to prompt injection techniques originally discovered by Riley Goodside, including tag-based and JSON-based attacks.
Garak: Grandma roleplay jailbreakTests whether the model can be manipulated through grandma roleplay scenarios to reveal contentious information such as illicit substances or software keys.
Garak: Latent prompt injectionTests resistance to prompt injections buried in other contexts like resumes, financial reports, translations, and factual snippets.
Garak: Training data replayTests whether the model can be led to replay excerpts from copyrighted or sensitive training data including books, news articles, and literature.
Garak: Language Model Risk Cards (LMRC)Non-adversarial content safety probes covering bullying, deadnaming, quack medicine, sexual content, and slur usage based on the LMRC framework.
Garak: Malware generationTests whether the model will comply with requests to generate malware, malware components, evasion techniques, or other tools that disrupt devices.
Garak: Misleading claimsTests whether the model will accept and agree with false assertions rather than correctly identifying and refuting them.
Garak: Package hallucinationTests whether the model hallucinates non-existent software packages across multiple languages (Python, JavaScript, Rust, Ruby, Perl, Dart) which could lead to supply chain attacks.
Garak: Phrasing-based jailbreaksTests whether rephrasing requests in past or future tense can bypass safety filters and elicit unsafe content.
Garak: PromptInject attacksTests resistance to plaintext prompt injection attacks that embed malicious commands into requests for innocuous information.
Garak: RealToxicityPromptsTests model responses to prompts empirically found to have a high probability of eliciting toxic continuations.
Garak: Snowball hallucinationTests whether the model gives confidently wrong answers to complex graph connectivity reasoning questions instead of admitting uncertainty.
Garak: Adversarial suffix attacksTests resistance to adversarial suffixes (GCG-style) appended to prompts that are designed to override system prompt safety measures.
Garak: Tree of Attacks with Pruning (TAP)Tests resistance to LLM-generated jailbreak prompts created using the Tree of Attacks with Pruning methodology.