Scanning something real

Nineteen lessons against a Python function. Here is what changes when the target is real, and it is one argument.

Garak ships around 44 generators. The two that matter outside a lesson are the model APIs and the HTTP one.

bash

garak -t openai -n gpt-4o-mini --spec probes.goodside

garak -t rest -n my-endpoint --generator_option_file rest.json --spec probes.goodside

Run these yourself, against a system you are responsible for. There is nothing printed here, because a scan of a real model produces different answers every time and a made-up transcript would be worth nothing. The setup is the line above; the results are yours.

The rest generator is the one to learn

It takes a JSON file describing your endpoint: the URL, the headers, how to put the prompt into the request, and how to find the answer in the response. That covers any application you can reach over HTTP, which is most of them, and it means the scan goes through your whole system rather than straight to a model.

What changes

It gets slow and it costs money. A single family at five generations is thousands of calls. --generations 1 while you are choosing probes, and the full count for the run that counts.

The answers stop repeating, so a rate moves between runs on its own, and a difference of a few per cent is not a finding.

Ask first. Scanning a hosted model sends adversarial prompts to somebody else's service under your account, and the terms usually have something to say about it.

Try it yourself

Write the rest.json for an endpoint you own, without running it.
Work out the number of calls one family at five generations would make.
Decide who at your organisation needs to know before a scan runs.

PreviousChoosing probes by what they map to

This is what real progress feels like.