Choosing probes by what they map to

Naming probe families works when you know the families. The other way in is the standard your customer already cares about.

Every probe carries tags, and the tags map to published taxonomies: the OWASP LLM top ten, AVID, and garak's own risk cards. tag: in the spec selects on them.

bash

garak -t function -n support_bot#reply --spec tag:owasp:llm01

That runs every probe tagged as prompt injection, whichever family it lives in, which is usually what a security review is actually asking for.

Reading a probe's tags

Example

garak --plugin_info probes.goodside.Tag 2>&1 | grep -E 'tags|tier|goal|intent'

Tags are how a scan turns into a sentence a reviewer recognises. A run selected by family says you tested some probes; a run selected by tag says you tested the category they asked about.

A tag is a claim about coverage, so check what it selected. The queue line names every probe that matched, and it is worth reading before you tell anyone the category is covered. An empty queue means the tag matched nothing, and the run still exits cleanly.

Try it yourself

Run a tag spec and count the probes in the queue line.
Find a probe with no tags at all and decide whether that matters.
Pick the tag that matches the risk your own application is most exposed to.

PreviousBuffs: changing the prompt on the way out

Slow is fine. Stopping is the only problem.