AI 红队测试与对抗安全审计实战指南

/**
 * 自动化红队测试框架核心
 * 支持多种攻击策略和评估方法
 */

interface RedTeamTest {
    id: string;
    strategy: 'roleplay' | 'nested' | 'adversarial' | 'progressive' | 'multimodal';
    severity: 'low' | 'medium' | 'high' | 'critical';
    promptTemplate: string;
    variables: Record<string, string[]>;
    expectedSafe: boolean;
}

interface TestResult {
    testId: string;
    prompt: string;
    response: string;
    isJailbroken: boolean;
    confidence: number;  // 评估置信度
    strategy: string;
    timestamp: string;
}

class AutomatedRedTeam {
    private tests: RedTeamTest[] = [];
    private results: TestResult[] = [];
    private evaluator: (text: string) => Promise<{ unsafe: boolean; score: number }>;

    constructor(evaluator: (text: string) => Promise<{ unsafe: boolean; score: number }>) {
        this.evaluator = evaluator;
    }

    addTest(test: RedTeamTest): void {
        this.tests.push(test);
    }

    /** 生成所有测试变体 */
    generateVariants(): Array<{ testId: string; prompt: string }> {
        const variants: Array<{ testId: string; prompt: string }> = [];
        for (const test of this.tests) {
            const keys = Object.keys(test.variables);
            const combos = this.cartesianProduct(keys.map(k => test.variables[k]));
            for (const combo of combos) {
                const varMap: Record<string, string> = {};
                keys.forEach((k, i) => varMap[k] = combo[i]);
                let prompt = test.promptTemplate;
                for (const [key, value] of Object.entries(varMap)) {
                    prompt = prompt.replace(new RegExp('\{\{' + key + '\}\}', 'g'), value);
                }
                variants.push({ testId: test.id, prompt });
            }
        }
        return variants;
    }

    /** 执行测试并评估 */
    async runTests(
        targetFn: (prompt: string) => Promise<string>
    ): Promise<RedTeamReport> {
        const variants = this.generateVariants();
        console.log(`共 ${variants.length} 个测试变体
`);

        for (const v of variants) {
            const response = await targetFn(v.prompt);
            const evalResult = await this.evaluator(response);
            const testResult: TestResult = {
                testId: v.testId,
                prompt: v.prompt,
                response,
                isJailbroken: evalResult.unsafe,
                confidence: evalResult.score,
                strategy: this.tests.find(t => t.id === v.testId)!.strategy,
                timestamp: new Date().toISOString()
            };
            this.results.push(testResult);
        }

        return this.generateReport();
    }

    /** 生成测试报告 */
    generateReport(): RedTeamReport {
        const total = this.results.length;
        const jailbroken = this.results.filter(r => r.isJailbroken);
        const asr = (jailbroken.length / total * 100).toFixed(1);

        // 按策略统计
        const byStrategy: Record<string, { total: number; success: number }> = {};
        for (const r of this.results) {
            if (!byStrategy[r.strategy]) {
                byStrategy[r.strategy] = { total: 0, success: 0 };
            }
            byStrategy[r.strategy].total++;
            if (r.isJailbroken) byStrategy[r.strategy].success++;
        }

        return {
            totalTests: total,
            jailbrokenCount: jailbroken.length,
            overallASR: parseFloat(asr),
            byStrategy,
            highSeverity: jailbroken.filter(r =>
                this.tests.find(t => t.id === r.testId)?.severity === 'critical' ||
                this.tests.find(t => t.id === r.testId)?.severity === 'high'
            ).length
        };
    }

    private cartesianProduct<T>(arrays: T[][]): T[][] {
        return arrays.reduce<T[][]>(
            (acc, curr) => acc.flatMap(a => curr.map(c => [...a, c])),
            [[]]
        );
    }
}

interface RedTeamReport {
    totalTests: number;
    jailbrokenCount: number;
    overallASR: number;
    byStrategy: Record<string, { total: number; success: number }>;
    highSeverity: number;
}

/**
 * Agent 权限边界测试框架
 * 验证 Agent 是否只在授权范围内操作
 */

interface AgentPermission {
  resource: string;
  actions: string[];
  conditions?: Record<string, unknown>;
}

interface PermissionTestCase {
  description: string;
  resource: string;
  action: string;
  expected: 'allow' | 'deny';
}

class AgentPermissionTester {
  private permissions: AgentPermission[];
  private testCases: PermissionTestCase[] = [];

  constructor(permissions: AgentPermission[]) {
    this.permissions = permissions;
    this.generateTestCases();
  }

  private generateTestCases(): void {
    for (const perm of this.permissions) {
      for (const action of perm.actions) {
        this.testCases.push({
          description: perm.resource + ' 的 ' + action + ' 操作应该被允许',
          resource: perm.resource,
          action,
          expected: 'allow'
        });
      }
      const allActions = ['read', 'write', 'delete', 'execute'];
      for (const action of allActions) {
        if (!perm.actions.includes(action)) {
          this.testCases.push({
            description: perm.resource + ' 的 ' + action + ' 操作应该被拒绝',
            resource: perm.resource,
            action,
            expected: 'deny'
          });
        }
      }
    }
    this.testCases.push(
      { description: '路径穿越攻击 ../etc/passwd', resource: '../../../etc/passwd', action: 'read', expected: 'deny' },
      { description: 'URL 编码的路径穿越', resource: '%2e%2e%2fetc%2fpasswd', action: 'read', expected: 'deny' }
    );
  }

  async runTests(
    agent: { call: (r: string, a: string) => Promise<{ allowed: boolean }> }
  ) {
    const results: (PermissionTestCase & { actual: string })[] = [];
    for (const tc of this.testCases) {
      try {
        const resp = await agent.call(tc.resource, tc.action);
        results.push({ ...tc, actual: resp.allowed ? 'allow' : 'deny' });
      } catch {
        results.push({ ...tc, actual: 'deny' });
      }
    }
    const passed = results.filter(r => r.actual === r.expected).length;
    console.log('权限测试: ' + passed + ' 通过, ' + (results.length - passed) + ' 失败');
    return { passed, failed: results.length - passed, total: results.length, details: results };
  }
}