DEFONEOS Adversarial Red-Team Framework

1 · Why a structured red-team framework exists

Sovereign-AI deployments in public services and defence face adversarial threats that generic AI safety evaluations do not cover. A prompt-injection attack on a consumer chatbot is embarrassing; the same attack on a DEFONEOS-powered COP (Common Operating Picture) feeding into a military decision cycle is operationally catastrophic. This framework defines the minimum adversarial testing every DEFONEOS deployment must pass before SEAL certification and before any pilot goes live.

It is designed to be runnable by a 2-person team in 2 days (Tier-1 automated) and scalable to a 10-person external red team over 2 weeks (Tier-3 BFT-supervised).

2 · The 12 Attack Vectors

3 · The 5 Severity Tiers

4 · Cross-Walk to Regulatory Regimes

5 · Automated Test Suite (Tier-1)

The automated suite runs on every commit to the DEFONEOS substrate and on every SEAL re-attestation cycle. It consists of 240+ adversarial prompts across the 12 vectors, executed against the target model in a hermetic test harness.

# Run the automated red-team suite
python -m defoneos.red_team --suite automated \
  --target http://localhost:3101/v1/chat/completions \
  --vectors 1-10 \
  --severity-threshold T2 \
  --output red-team-report-T{timestamp}.json

# Key outputs:
# - pass/fail per vector
# - severity classification per finding
# - SIGIL-anchored evidence pack (for SEAL audit trail)
# - BFT-council-readable summary

The suite is designed to produce zero false positives at T2+ — every finding at T2 or above is manually reviewed before being filed. T1 findings are logged but do not block deployment.

6 · Manual Red-Team Protocol (Tier-2 + Tier-3)

Tier-2: Internal Manual (2-person team, 2 days)

1. Day 1 AM: Reconnaissance — model capability mapping, tool/MCP inventory, RAG corpus audit, access-control review.
2. Day 1 PM: Vectors 1-6 (prompt injection, data extraction, supply chain, DoS, excessive agency) — manual crafting + automated augmentation.
3. Day 2 AM: Vectors 7-10 (PII leakage, inversion, GCG, jailbreak) — focused exploitation attempts.
4. Day 2 PM: Report — all findings classified by tier, SIGIL-anchored, filed to BFT council log.

Tier-3: External + BFT-Supervised (10-person team, 2 weeks)

1. Week 1: External accredited red team (NCSC CHECK-certified or equivalent) conducts full-scope assessment including Vectors 11-12.
2. Week 2: BFT council reviews all findings. ≥5 Generals must sign off on the severity classification. Any T4/T5 triggers an emergency BFT session (quorum 25/33, 72h window).
3. Output: SEAL-evidence-grade report filed to csoai.org/red-team/{deployment_id}/{cycle}.

7 · Red-Team Cadence

8 · Reporting & Evidence Chain

Every red-team engagement produces a SIGIL-anchored evidence pack:

{
  "engagement_id": "RT-{deployment_id}-{timestamp}",
  "team": "internal | external-accredited | bft-supervised",
  "vectors_tested": [1,2,3,...,12],
  "findings": [
    {
      "vector": 1,
      "severity": "T2",
      "title": "System prompt extraction via role-play",
      "payload_redacted": true,
      "reproduction_steps": "...",
      "remediation": "Implemented system-prompt isolation layer",
      "re_test_result": "PASS",
      "sigil": "RT-{id}-V1-T2-{hash}"
    }
  ],
  "bft_review": {
    "generals_reviewed": 5,
    "approve": 5,
    "amend": 0,
    "reject": 0
  },
  "seal_evidence": true
}

This pack is filed to the AI-BOM §7 (Security Testing) and is a mandatory input for SEAL certification at Silver+ tiers.

9 · Named Anti-Patterns (What NOT to do)

1. NO "we tested it ourselves and it's fine." Tier-3 external assessment is mandatory for Gold+ SEAL. Self-attestation is not evidence.
2. NO "we ran the automated suite, no findings." Zero findings on a 240-prompt automated suite is a red flag, not a clean bill of health. It means the suite is likely misconfigured.
3. NO "the model refused all adversarial prompts, so it's safe." Refusal is one defence layer. Vectors 8, 11, 12 test infrastructure, not just model behaviour.
4. NO "we'll fix T3 findings after launch." T3+ findings block deployment. No exceptions, no waivers, not even from the human-owner.
5. NO "red-team reports are internal, no one needs to see them." SEAL certification requires the evidence pack. NCSC + UK AISI notification is mandatory for T4+.
6. NO "supply-chain vector doesn't apply, we only use our own MCPs." Every MCP in the federation is a supply-chain attack surface. Vector 4 is tested for all deployments regardless of architecture.
7. NO "SIGIL is cryptographically secure, we don't need to test Vector 12." Cryptographic primitives are necessary but not sufficient. Implementation bugs, key management, and replay attacks are tested.

10 · DEFONEOS Red Lines (Immutable)

11 · Integration with DEFONEOS Pipeline

12 · Applicant Next Steps

1. Review this framework: curl https://csoai.org/defoneos-mod-adversarial-red-team-framework.html | shasum -a 256
2. Run the automated suite: pip install defoneos-red-team && python -m defoneos.red_team --suite automated
3. Schedule a Tier-2 manual assessment: redteam@csoai.org
4. Review the AI-BOM template: /defoneos-mod-ai-bom-sbom-card.html
5. Review the SEAL certification spec: /defoneos-mod-seal-certification-spec.html
6. Inspect BFT council composition: csoai.org/seal/council