Compliance
Put adversarial testing into the AI governance loop.
Adversarial testing of deployed models and AI features, with baseline comparison after model changes, mapped into risk-management and robustness workflows.
Surfaces this draws on
The problem
AI security can regress without a code vulnerability.
A model changes. A system prompt changes. A fine-tuning dataset changes behavior. A new model version is deployed. An application adds retrieval or a new context source.
The system may still pass functional tests while its security behavior changes. That is why AI security needs repeated adversarial validation rather than a one-time review.
Current scope
What RedMaw tests today
- Direct prompt injection
- Indirect prompt injection
- Sensitive-information disclosure
- System-prompt disclosure
- Jailbreaks
- Control bypass
- Model and endpoint posture
- Security regressions after fine-tuning or retraining
- Adversarial testing in CI / release pipelines
Testing works against deployed endpoints, while release-pipeline testing compares a candidate model version against the last accepted baseline.
Evidence
Adversarial evidence, not a safety declaration
A useful AI security result shows:
- The model or endpoint tested
- The version or candidate release, where available
- The adversarial technique
- The prompt or input used
- The resulting behavior
- The control that failed
- Whether the behavior is reproducible
- Remediation state and the result after retest
Relevant AI findings are mapped to MITRE ATLAS, and the exact prompt and response evidence associated with a result is preserved.
Release gate
Make the test part of the release
AI red-teaming integrates into the CI or model-release workflow. A retrain or model-registry event triggers the adversarial suite against the candidate version, and the result is compared against the last passing baseline.
If the change introduces a new security regression, the release can be blocked.
Governance
Risk-management and robustness evidence
EU AI Act readiness maps AI red-team findings to risk-management and robustness obligations for relevant high-risk AI systems, and the resulting testing evidence can be exported into that governance workflow.
Boundaries
Two claims RedMaw will not make
Output
What RedMaw provides for EU AI Act
All of it produced by the security work itself, not assembled separately at audit time.
- Repeatable AI adversarial testing
- Evidence of prompt injection and control bypass
- Sensitive-information and system-prompt disclosure testing
- Model and endpoint posture
- Baseline comparison and release-gate results
- MITRE ATLAS mapping, remediation state and retest evidence
Other frameworks
Same loop, different evidence
Make EU AI Act evidence easier to produce.
Continuously validate exposure, preserve the evidence, and re-test remediation.