Red-team audit for LLM and agentic shopping assistants

Leaderboard

Attack success rate by defense

Per-category ASR

How an audit runs

1. Poison — hidden instructions from the case are planted into the product catalog.
2. Defend — selected plugins act at retrieval (rag_guard), content (sanitizer) and output (policy_guard) level.
3. Answer — a deterministic mock shopping agent ranks the catalog and paraphrases what it retrieved. Its only flaw is the realistic one: it trusts retrieved content.
4. Judge — a rule-based dual-channel judge looks for PII disclosure, untrusted destinations, executed instructions and category failure signals.
5. Grade — a verdict (PASS / FAIL) plus a hazard grade derived from the category severity.

Reading the leaderboard

Each plugin has a deliberately different coverage profile, which is the point of the framework:

• sanitizer kills injected instructions and unverifiable claims, but is blind to ranking manipulation and metadata exposure.
• rag_guard removes poisoned listings at retrieval. Powerful, but it over-blocks, and it cannot see a fabricated spec that looks exactly like a real one.
• policy_guard only rewrites the answer. It stops PII leaks and phishing redirects and nothing else.

Product hallucination is the category no rule-based defense solves. Fabricated but plausible specs ("30-day battery life", "#1 best seller", "50,000 units sold") are lexically indistinguishable from real ones. Closing that gap needs grounding and external verification, which is the open research direction.

Limitations

• The agent under test is a deterministic mock, not a real LLM. Absolute ASR values describe this mock; what transfers to real agents is the relative coverage profile of the defenses and the taxonomy itself.
• Only the rule channel of the judge runs here. The full RecRedTeam framework adds an optional LLM judge channel and LangGraph / OpenAI-Agents adapters.
• Attacks target a local simulated catalog, never a real system.
• This page is a static snapshot: the engine ran once over the public split and the results were frozen. Rebuild them with python build_static.py.

Links

• Dataset — NoahIsARider/RecRedTeam-ASI-Bench
• Framework — github.com/NoahIsARider/RecRedTeam
• Reference Gradio implementation — app.py in this repo, run it locally with pip install -r requirements.txt && python app.py
• Author — Fangyanuo Zhou · noahisarider.github.io