SPECTER GUARDRAIL-DOS is Red Specter's LLM guardrail denial-of-service platform — a 19-subsystem attack framework for exhausting safety mechanisms, bypassing content filters, amplifying jailbreak techniques, and disabling output restrictions. It exploits the fundamental tension between guardrail strictness and model utility to force guardrails into failure modes. Where traditional defenses assume guardrails are always present, GUARDRAIL-DOS proves they can be disabled.
Identify guardrail resource constraints. Exhaust safety budgets through repeated queries. Overwhelm monitoring systems. Force fallback to permissive modes.
Systematically evade content filters through encoding, semantic rewriting, multi-turn deception, and jailbreak amplification techniques.
Disable safety mechanisms through prompt crafting, context overflow, goal hijacking, and output channel manipulation.
Exploit feedback mechanisms to self-reinforce corruption. Inject malicious outputs back into training pipelines. Achieve multi-turn persistence.
Every subsystem performs a discrete attack phase. All 19 chain together for end-to-end guardrail inversion. Each subsystem produces structured JSON findings mapped to MITRE ATLAS guardrail evasion tactics.
| # | Subsystem | Description |
|---|---|---|
| 01 | Enumerate Guardrails | Probing attack surface. Identify guardrail endpoints via HTTP discovery. Infer LLM family (Claude, GPT, Gemini). |
| 02 | Map Output Channels | Enumerate output delivery mechanisms (logging, training data, feedback, API responses). Multi-channel analysis. |
| 03 | Fingerprint Trust Dependencies | Identify trust chains. Map model reliance on external safety services. Detect verification bypass opportunities. |
| 04 | Craft Inversion Payload | Generate model-specific jailbreak payloads. Context-aware crafting for Claude, GPT-4, Gemini, DeepSeek. |
| 05 | PRION Mutate | GPU-accelerated mutation engine. PyTorch-based genetic algorithm. 20x CPU speedup on RTX 3090. |
| 06 | Inject Inversion | Deliver payloads via API, headers, context injection. Real-time delivery validation. Persistence testing. |
| 07 | Weaponise Output | Identify downstream actions. Map output to allow decisions. Calculate real-world impact chain. |
| 08 | Poison Feedback Loop | Self-reinforcing corruption cycles. Inject outputs back into training. Multi-turn persistence analysis. |
| 09 | Persist Inversion | Reset survival testing. Retraining persistence. Corruption durability across model updates. |
| 10 | Propagate Inversion | Fleet-wide propagation measurement. Stochastic targeting of multi-instance guardrails. |
| 11 | Report | Ed25519 + ML-DSA-65 dual-signed reporting. MITRE ATLAS mapping. RFC 3161 timestamping. |
| 12 | Guardrail Exhaustion | Safety budget depletion. Resource constraint identification. Fallback mode triggering. |
| 13 | Safety Mechanism Bypass | Filter evasion via encoding, obfuscation, semantic rewriting. Multi-step jailbreak chains. |
| 14 | Output Channel Exploitation | Direct API response injection. Logging system abuse. Training data poisoning. |
| 15 | Context Overflow | Token limit exploitation. Context window saturation. Attention head saturation attacks. |
| 16 | Goal Hijacking | Instruction set replacement. Objective inversion. Multi-turn goal drift. |
| 17 | Jailbreak Amplification | DAN variant synthesis. Persona hijacking. Hypothetical framing amplification. |
| 18 | Compliance Monitoring | Verify bypass success. Measure guardrail corruption. Quantify safety degradation. |
| 19 | ROE Enforcement | Ed25519 signed Rules of Engagement file validation. Access control at INJECT+ gates. |
Multi-level gate system enforces operational security. ROE file validation at INJECT+ gates. Ed25519 key verification for INVERT gate. UNLEASHED gate requires dual confirmation.
| Gate | Requirements | Purpose |
|---|---|---|
| OPEN | None | Reconnaissance subsystems only. Enumerate guardrails, map channels, fingerprint dependencies. |
| INJECT | ROE file | Payload delivery and injection. Requires signed Rules of Engagement file. |
| INVERT | ROE file + Ed25519 signature | Full guardrail inversion. Feedback loop poisoning. Persistence testing. |
| UNLEASHED | ROE + Key + Confirmation | Unrestricted mode. Fleet propagation. Founder's authorization only. |
Every attack vector mapped to MITRE ATLAS framework. WMD classification: Capability, Consequence, Severity.
Reconnaissance-only attacks. Enumerate guardrail endpoints. Map output channels. Fingerprint trust dependencies. No payload delivery.
Payload delivery attacks. Jailbreak delivery via API, headers, context. Single-turn exploitation. Requires ROE file.
Multi-turn and retraining persistence. Feedback loop poisoning. Corruption survival across resets and model updates.
Guardrail bypass achieved. Safety mechanism disabled. Unrestricted outputs generated. Single instance compromised.
Inversion propagates to multiple guardrail instances. Fleet-wide corruption. Systemic safety degradation.
Critical layer. LLM safety mechanism warfare. Direct guardrail inversion. High-stakes AI security impact.
Red Specter T174 SPECTER GUARDRAIL-DOS is intended for authorised security research and defensive evaluation only. Unauthorised use against systems you do not own or have explicit permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation. All operations require signed ROE files and explicit client authorization. This is a commercial security testing tool — equivalent to Metasploit, Cobalt Strike, or Burp Suite.