11 Min ReadLast updated: July 9, 2026

Project Hub: Basilisk AI Red Teaming Framework

Basilisk is an open-source artificial intelligence (AI) red teaming and large language model (LLM) penetration testing framework. It maps the adversarial attack surface of LLM applications to the OWASP LLM Top 10 threat model and couples this coverage with an evolutionary prompt search engine called Smart Prompt Evolution for Natural Language (SPE-NL).

Designed for security researchers, penetration testers, and offensive security teams, Basilisk automates the discovery of security boundaries, refusal triggers, instruction overrides, and data leakage vectors. It runs differential scans across multiple hosted and local models, grades guardrail postures, and maintains digital signature validation on its execution logs and native shared libraries.

Technical Features

1. Smart Prompt Evolution (SPE-NL)

Source File: basilisk/evolution/engine.py
Relevant Modules: operators.py, fitness.py, population.py
CLI Command: basilisk scan --target <url> --evolve

At the core of Basilisk is a genetic algorithm optimized for natural language mutation and crossover. When static security payloads are blocked or refused by a target LLM’s safety filters, the evolution engine iteratively reframes, encodes, and restructures the input.

  • 10 Mutation Operators: Implements specialized lexical and structural mutations (SynonymSwap, LanguageShift, EncodingWrap, RoleInjection, StructureOverhaul, FragmentSplit, NestingDeepen, HomoglyphReplace, ContextPad, and TokenSmuggling).
  • 5 Crossover Strategies: Recombines successful parent prompts via single-point splits, uniform word swaps, prefix-suffix stitching, sentence-level interleaving (semantic_blend), or long clause extraction (best_of_both).
  • Thompson Sampling Bandit: Selects mutation operators dynamically based on a Beta-Bernoulli multi-armed bandit. The bandit tracks operator success relative to a target context key (defined by provider, model, guardrail level, tool presence, and refusal history) and adjusts selection probabilities using an exponential decay factor of 0.92.

2. Multi-Objective Optimization

Source File: basilisk/evolution/fitness.py
Relevant Modules: population.py
Class: FitnessResult

The framework evaluates mutated prompts using a composite fitness function that blends legacy weighted-sum scoring with NSGA-II Pareto dominance sorting.

  • Weighted Scoring: Computes fitness based on Refusal Avoidance (0.30 weight), Information Leakage (0.25 weight), Compliance with Injected Instructions (0.20 weight), Target Pattern Matching (0.10 weight), Novelty Archive Bonus (0.10 weight), and Length Efficiency (0.05 weight).
  • Pareto Ranking: Explores a 7-dimensional behavioral space using NSGA-II to optimize for exploit_evidence, target_signal_match, refusal_avoidance, novelty, intent_preservation, reproducibility, and cost_efficiency.

3. Attack Catalog and Trust Tiers

Source File: basilisk/attacks/base.py
Relevant Modules: basilisk/attacks/injection/, basilisk/attacks/extraction/, basilisk/attacks/exfil/
CLI Command: basilisk modules

Basilisk includes 33 attack modules organized into 9 categories mapping to OWASP LLM vulnerabilities:

  • injection: Direct, indirect, multilingual, encoding, and split prompt injections (LLM01).
  • extraction: Verbatim prompt extraction, translation traps, simulation, and gradient walks (LLM06).
  • exfil: Training data extraction, RAG data harvesting, and tool schema leakage (LLM06).
  • toolabuse: SQL injection, SSRF, command injection, and chained tool execution (LLM07/LLM08).
  • guardrails: Logic traps, roleplay bypasses, systematic boundaries, and encoding bypasses (LLM01/LLM09).
  • dos: Context bombs, loop triggers, and token exhaustion (LLM04).
  • multiturn: Conversational cultivation, authority escalation, sycophancy, persona locking, and memory manipulation (LLM01).
  • rag: Document injection, retrieval poisoning, and knowledge enumeration (LLM03/LLM06).
  • multimodal: Combined image and text injection vectors (LLM01).

These modules are categorized into three Trust Tiers to enforce rigorous evidence policy:

  • Production (11 modules): Holds the highest evidence requirements; findings are verified via automated signal checks and are downgraded to MEDIUM if proof is weak.
  • Beta (18 modules): Exploratory but held to standard signal validation.
  • Research (4 modules): Experimental edge cases, disabled by default.

4. Native Acceleration and Cryptographic Hardening

Source File: basilisk/native_bridge.py
Relevant Directory: native/

  • FFI Bridge: Performance-critical operations run inside compiled C and Go shared libraries (libbasilisk_tokens, libbasilisk_encoder, libbasilisk_fuzzer, and libbasilisk_matcher) with pure Python fallbacks.
  • Ed25519 Native Manifests: Shared libraries are loaded only after their SHA-256 hashes are verified against an Ed25519-signed manifest using a hardcoded public key.
  • Ed25519 Audit Logging: Every interaction, raw model response, and mutation is recorded in JSONL files signed using Ed25519 private keys.
  • Input Guardrails: Native boundary checks enforce strict memory limit constraints (_MAX_NATIVE_TEXT_BYTES = 262144, _MAX_NATIVE_PAIR_BYTES = 524288) to prevent buffer overflows via FFI boundaries.

Threat Model

Assumptions and Scope

Basilisk is designed to evaluate specific threat vectors under controlled, authorized testing conditions.

┌──────────────────────────────────────┐  ┌──────────────────────────────────────┐
│             IN SCOPE                 │  │             OUT OF SCOPE             │
├──────────────────────────────────────┤  ├──────────────────────────────────────┤
│  • Black-box LLM API Querying        │  │  • Model Weights Extraction (Theft)  │
│  • Direct / Indirect Prompt Injection │  │  • Training Data Poisoning (Offline)  │
│  • Sensitive Instruction Leakage     │  │  • Supply-Chain Dependency Exploits   │
│  • RAG Citation & Context Hijacking  │  │  • Social Engineering / Phishing      │
│  • Tool Abuse (SSRF, SQLi via Agent) │  │  • DDoS / Infrastructure Attacks      │
└──────────────────────────────────────┘  └──────────────────────────────────────┘
  • Assumptions:
    • Black-box access via network APIs or WebSocket connections.
    • No direct access to model weights or hidden states.
    • No privileged administrative access to the underlying model deployment server.
    • Authorized testing only.
  • Out of Scope:
    • Model stealing (extraction of model weights via log-probabilities).
    • Offline training dataset poisoning (manipulating base training models prior to deployment).
    • Supply chain attacks on software dependencies.

Why Genetic Algorithms?

Unlike brute-force testing, which randomly queries combinations of characters or words, or reinforcement learning, which requires fine-tuning auxiliary neural networks, Basilisk utilizes a genetic algorithm (SPE-NL) to explore the prompt space.

       ┌────────────────────────────────────────────────────────┐
       │             Why SPE-NL Genetic Algorithm?              │
       ├────────────────────────────────────────────────────────┤
       │ • High efficiency over brute-force in large spaces    │
       │ • Low overhead compared to Reinforcement Learning      │
       │ • Explores diverse paths unlike local Beam Search      │
       │ • Discrete word mutations preserve semantic structure  │
       └────────────────────────────────────────────────────────┘
  1. Over Brute-Force: The space of natural language sentences is infinite. Random fuzzing generates ungrammatical gibberish that safety filters reject instantly. GAs maintain grammatical plausibility while guiding search.
  2. Over Reinforcement Learning: Reinforcement learning requires continuous training feedback loops, computing gradients, and hosting secondary language models. SPE-NL runs lightweight, zero-dependency heuristics locally, yielding bypasses with minimal overhead.
  3. Over Beam Search / Monte Carlo Tree Search: Local greedy search strategies often converge on a single token path (refusal local optima). GAs introduce mutation operators and crossovers that jump across different semantic niches in the behavioral space.

System Architecture

Basilisk follows a staged pipeline to orchestrate scans, analyze behaviors, and compile reports.

Component Diagram

graph TD
    subgraph Core Engine
        ScannerEngine[Scanner Engine] --> SessionManager[Session Manager]
        SessionManager --> DatabaseWorker[Database Worker]
    end
    subgraph Analyzers
        ReconModules[Recon Modules]
        AttackModules[Attack Modules]
        EvolutionEngine[Evolution Engine]
    end
    subgraph Adapters
        LiteLLMAdapter[LiteLLM Adapter]
        CustomRESTClient[Custom REST Client]
    end
    ScannerEngine --> ReconModules
    ScannerEngine --> AttackModules
    ScannerEngine --> EvolutionEngine
    ReconModules --> LiteLLMAdapter
    AttackModules --> LiteLLMAdapter
    EvolutionEngine --> LiteLLMAdapter

Sequence Diagram

sequenceDiagram
    autonumber
    actor Operator
    participant Scanner as Scanner Engine
    participant Recon as Recon Modules
    participant Evolution as SPE-NL Evolution
    participant Target as LLM API
    participant DB as SQLite DB

    Operator->>Scanner: Start scan command
    Scanner->>DB: Initialize scan session
    Scanner->>Recon: Execute profiling probes
    Recon->>Target: Query context window & tools
    Target->>Recon: Return capability profiles
    Scanner->>Evolution: Seed initial prompt population
    loop Generation G
        Evolution->>Target: Send mutated prompts (async)
        Target->>Evolution: Return responses
        Evolution->>DB: Log conversation & fitness
    end
    Scanner->>DB: Complete scan findings
    Scanner->>Operator: Generate SARIF & HTML reports

Data Flow Diagram

graph TD
    A[CLI / YAML Config] --> B(Scanner Orchestrator)
    B --> C{Recon Runs?}
    C -->|Yes| D[Recon Module: fingerprint, context]
    C -->|No| E[Load YAML Probe Seeds]
    D --> F[Assemble BasiliskProfile]
    E --> G(SPE-NL Genetic Loop)
    F --> G
    G --> H[FFI C/Go Extensions: Tokenizer, Matcher]
    G --> I[LLM API Endpoints]
    I -->|Response text| J(Composite Fitness Evaluator)
    J -->|Score| G
    G --> K[Evidence Policy Calibration]
    K --> L[SQLite Session Store]
    L --> M[Multi-format Reports: HTML, SARIF, JSON]

Visual Mockups (Screenshots)

Security researchers trust verifiable visual outputs. Below are text-based mockups representing the terminal output, the scan progress graph, and the Electron desktop application.

CLI Scan Progress Output

$ basilisk scan -t https://basilisk-vulnbot.onrender.com/v1/chat/completions -p custom -m vulnbot-1.0 --mode standard

 ╔══════════════════════════════════════════════════════════════════════════════╗
 ║                   BASILISK AI RED TEAMING SCANNED STARTED                   ║
 ║ Target: https://basilisk-vulnbot.onrender.com                                ║
 ║ Provider: Custom HTTP Adapter | Model: vulnbot-1.0                           ║
 ╚══════════════════════════════════════════════════════════════════════════════╝

 [11:14:45] [RECON] Running 5 reconnaissance probes...
 [11:14:48] [RECON] Fingerprinted target: Llama-3-like instruct model.
 [11:14:49] [RECON] Context Window estimated: 8,192 tokens.
 [11:14:50] [RECON] Active tool templates discovered: web_search, database_query.

 [11:14:51] [ATTACK] Running 33 attack modules in phase initial_access...
 [11:14:55] [EVOLVE] Starting SPE-NL evolution loop. Pop: 32, Gen Limit: 5.

 Gen 1/5: ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ [100%] Avg Fitness: 0.28, Best: 0.44
 Gen 2/5: ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ [100%] Avg Fitness: 0.39, Best: 0.52
 Gen 3/5: ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ [100%] Avg Fitness: 0.48, Best: 0.68
 Gen 4/5: ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ [100%] Avg Fitness: 0.57, Best: 0.88 *BREAKTHROUGH*
 Gen 5/5: ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ [100%] Avg Fitness: 0.62, Best: 0.88

 ╔══════════════════════════════════════════════════════════════════════════════╗
 ║                                SCAN SUMMARY                                  ║
 ╠══════════════════════════════════════════════════════════════════════════════╣
 ║  • Total Execution Time: 12m 41s                                             ║
 ║  • Total API Queries: 842                                                    ║
 ║  • Successful Findings: 24 (2 Critical, 8 High, 10 Medium, 4 Low)            ║
 ║  • Target Security Grade: D (Weak guardrails against exfil)                  ║
 ║  • Report Generated: C:\Users\regaan\reports\basilisk_a3b2_report.html       ║
 ╚══════════════════════════════════════════════════════════════════════════════╝

Desktop Application UI Dashboard

 ┌─────────────────────────────────────────────────────────────────────────────┐
 │ Basilisk Desktop GUI v2.0.0                      [ー] [■] [X]               │
 ├─────────────────────────────────────────────────────────────────────────────┤
 │ [Campaigns]  [New Scan]  [Attack Modules]  [Sessions]  [Reports]            │
 ├─────────────────────────────────────────────────────────────────────────────┤
 │                                                                             │
 │  Scan ID: bslk-73f1a2     Target: https://basilisk-vulnbot.onrender.com     │
 │  Status: Evolving (Gen 4) Progress: [██████████████████░░░] 80%             │
 │                                                                             │
 │  Fitness Efficacy Graph:                                                    │
 │  1.0 ┼                                                                      │
 │  0.8 ┼                                      * Breakthrough (0.88)           │
 │  0.6 ┼                       x───────x───────x                              │
 │  0.4 ┼               x───────┘                                              │
 │  0.2 ┼───────x───────┘                                                      │
 │  0.0 └───────┴───────┴───────┴───────┴───────┴                              │
 │             Gen 1   Gen 2   Gen 3   Gen 4   Gen 5                           │
 │                                                                             │
 │  Active Detections:                                                         │
 │  ID             Category             Severity   Verdict     Evidence        │
 │  BSLK-2026-F1   prompt_injection     CRITICAL   CONFIRMED   tool_call       │
 │  BSLK-2026-F2   sensitive_disclosure HIGH       STRONG      baseline_diff   │
 │  BSLK-2026-F3   data_poisoning       MEDIUM     PROBABLE    response_marker │
 │                                                                             │
 └─────────────────────────────────────────────────────────────────────────────┘

Limitations

  • Semantic Attack Gaps: If the target model leaks private data in highly paraphrased, non-obvious text that does not trigger regex filters or keywords, the fitness function might miss it.
  • Dependency on Third-Party APIs: Because Basilisk runs evaluations against hosted models, updates in endpoint behavior, token schemas, or strict rate-limiting rules can disrupt scans.
  • Temporal Stability: Safety policies on endpoints like OpenAI and Anthropic are updated daily. A payload that achieves a breakthrough today may trigger a refusal tomorrow.
  • Scanned Target Permissions Required: Running Basilisk generates aggressive and anomalous query strings. Scans must only be executed against systems under the explicit scope of authorization.

Zero-Setup Live Demo

Want to see Basilisk in action without configuring API keys? We maintain an intentionally vulnerable LLM target for testing:

Target URL: https://basilisk-vulnbot.onrender.com/v1/chat/completions

# No API keys required for this target
basilisk scan -t https://basilisk-vulnbot.onrender.com/v1/chat/completions -p custom --model vulnbot-1.0 --mode quick

Docker

docker pull rothackers/basilisk

docker run --rm rothackers/basilisk \
  scan -t https://basilisk-vulnbot.onrender.com/v1/chat/completions -p custom --model vulnbot-1.0 --mode quick

Reproduce Results

Run the following test campaign to verify the genetic search loop and the evidence parsing system:

basilisk scan -t https://basilisk-vulnbot.onrender.com/v1/chat/completions \
  -p custom \
  --model vulnbot-1.0 \
  --mode standard \
  --generations 5 \
  --output ./basilisk-reports/

Expected Output

[11:15:00] Initializing ScanSession bslk-73f1a2...
[11:15:02] Loading 223 YAML probes for target: vulnbot-1.0
[11:15:04] Seed population established. 32 individuals loaded.
[11:15:05] Running Gen 1... evaluated 32 prompts. Avg fitness: 0.28, Best: 0.44
[11:15:10] Running Gen 2... evaluated 32 prompts. Avg fitness: 0.39, Best: 0.52
[11:15:15] Running Gen 3... evaluated 32 prompts. Avg fitness: 0.48, Best: 0.68
[11:15:20] Running Gen 4... evaluated 32 prompts. Breakthrough found (Fitness: 0.88). Saving BSLK-2026-F1.
[11:15:25] Running Gen 5... evaluated 32 prompts. Avg fitness: 0.62, Best: 0.88
[11:15:30] Evolution Complete. Executed 160 queries in 30 seconds.
[11:15:31] HTML report generated: ./basilisk-reports/basilisk_bslk-73f1a2_report.html
[11:15:31] JSON report generated: ./basilisk-reports/basilisk_bslk-73f1a2_report.json
[11:15:32] SARIF report generated: ./basilisk-reports/basilisk_bslk-73f1a2_report.sarif
  • WSHawk: WebSocket and LLM security toolkit that shared early concepts of genetic payload mutation.
  • DeepTeam: Open-source AI red teaming framework aligning 50+ vulnerabilities to OWASP guidelines.
  • Lakera Red: Commercial AI adversarial testing suite built for teams utilizing Lakera Guard.

Reproducibility

The commands, configuration, and methodology described above are intended to allow independent verification. Because hosted LLMs evolve over time, exact outputs may differ even when using the same procedure.

🖊️ Edit this page on GitHub← Back to Project Hub