Positioning
garak is a command-line scanner that treats an LLM as a network service to be probed. You point it at a target (a hosted API, a Hugging Face model, a REST endpoint), pick probes, and it sends adversarial prompts and records what comes back. The repository is NVIDIA/garak, licensed Apache-2.0, with about 9.6k GitHub stars as of October 2026 1. The architecture is five plugin types: probes generate attack interactions, generators wrap the target model, detectors decide whether an output shows the failure, evaluators report, and harnesses structure the run 1. Buffs, a sixth type, rewrite probe prompts before they reach the target (base64, character codes, lowercasing, paraphrase, low-resource-language translation).
By default the probewise harness runs each probe and applies the detectors that probe nominates as primary and extended 1. In v0.17.1, --list_probes on a fresh install printed 191 probe classes and --list_detectors printed 117 detectors; --list_generators includes Anthropic, OpenAI, Bedrock, Azure, Cohere, Groq, Hugging Face, LiteLLM, NeMo Guardrails, and a generic REST generator. Those counts are from a local install and move every release.
Figure: garak scan pipeline: a --spec selection picks probes and buffs, probes emit attack prompts (optionally rewritten by a buff such as base64), the generator sends them to the target LLM, detectors score every output, and the evaluator writes report.jsonl and a hit log of the attempts that failed.
Strengths
- Breadth for free. One command runs hundreds of known attack patterns (DAN-style jailbreaks, encoding-based injection, XSS exfiltration, API-key completion, PII leakage) with no dataset to write. As a first pass on a new model or a new system prompt it is the cheapest red-team signal available.
- Recent releases track the field. v0.15.1 (June 5, 2026) added ProPILE probes for PII leakage 2. v0.16.0 (August 4, 2026) added technique and intent annotation, a unified
run.spec selection syntax, and a native Anthropic generator 2. v0.17.0 (September 9, 2026) added an EU AI Act mapping that tags probe results by the Act's risk categories and moved Python support to 3.11 through 3.13; v0.17.1 (October 16, 2026) added a hit@k attack success rate and Python 3.14 2.
- Many targets, one interface. Swapping
--target_type moves the same probes from OpenAI to Bedrock to a local Hugging Face model, which makes cross-model comparisons cheap.
- Machine-readable output. Each run writes a
report.jsonl of attempts plus an HTML summary, and the v0.17.1 digest entry carries the hit@k metric, so results diff in CI 2.
Limitations
- A hit is a detector firing, not a harm. Most detectors are string, regex, or small-classifier checks on the output. A refusal phrased unusually counts as a pass; a polite partial compliance can count as one too. Treat the attack success rate as a regression number for your own system, not as a measure of how dangerous the model is, and read a sample of hits and misses by hand before reporting either.
- Probes get stale. The attacks are public, so frontier models are trained against them. A clean run on an old probe set says little about novel attacks, and a bad run on a dated probe may be a false alarm.
- Single-turn bias. Most probes are one prompt, one response. Multi-turn and agentic attack chains are a thin part of the library, so a tool-using agent needs custom work or a different tool.
- Breaking changes between minors. v0.16.0 marked the old selection flags (
--probes, --probe_tags, --buffs) deprecated in favour of --spec, moved probe_spec and buff_spec into the run config, and changed the report.jsonl structure 2. The old flags still work for now; old YAML configs and old report parsers break. Pin the version.
- Heavy install. The default wheel pulls in torch, transformers, and a dozen provider SDKs. Use a dedicated venv or container.
- No managed product. No dashboard, no team workflow, no scheduling. You build those around the JSONL.
Best fit
Security and safety teams that want a fast, scriptable baseline of known attacks before a launch, a model swap, or a system-prompt change. Pair it with a custom attack set that reflects your own tools and data, and with the program structure in red team program design. Background reading: prompt injection taxonomy, jailbreaks and defenses, and the EU AI Act cheatsheet if you plan to use the v0.17 risk-category tags in a compliance file. Treat the tags as a labelling aid, not as evidence of conformity.
Getting started
These commands were run against garak 0.17.1 on Python 3.11 in a fresh venv, on October 17, 2026 3. The 0.16 spec syntax replaces the older --probes flag 2.
python -m venv venv-garak && source venv-garak/bin/activate
python -m pip install -U garak
garak --list_probes # probe modules and classes
garak --list_buffs # encoding, lowercase, paraphrase, ...
garak --list_generators # anthropic, openai, bedrock, huggingface, rest, ...
# smoke test with no API key: built-in blank generator, built-in test probe
garak --target_type test.Blank --spec probes.test.Test
# a real scan: encoding-based injection against an OpenAI model
export OPENAI_API_KEY=...
garak --target_type openai --target_name gpt-5-nano --spec probes.encoding
# select by module, exclude a class, add a tag, add a buff
garak -t openai -n gpt-5-nano -S "probes.dan,-probes.dan.DanInTheWild,tag:owasp:llm01,buffs.lowercase"
The test.Blank run took seconds and printed always.Pass: PASS ok on 40/40. It wrote ~/.local/share/garak/garak_runs/<prefix>.report.jsonl and an HTML summary; a run with failures also produces a hit log of the failing attempts. The spec grammar is probes.<module>[.<Class>], buffs.<module>[.<Class>], tag:<prefix>, and tier:<N>, with a leading - to exclude 4. Run garak --help for the current flags; the config file schema changed in 0.16, so do not copy YAML from older posts.
Pricing notes
Free under Apache-2.0 1. Cost is the target model's API calls: a probe with many prompts times --generations (default 5 per prompt) multiplies fast, and buffs multiply it again. Start with one probe module and a cheap model, and read the token bill before running all.
Alternatives
Promptfoo red teaming generates attacks tailored to your application's purpose and runs inside the same config as your regression evals 5; it fits CI better, while garak fits a model-level sweep. Giskard can run third-party scanners through its third_party_scan() API and adds its own agent-focused scan 6. If you need scored, sandboxed safety evals on frontier models, look at Inspect AI. In practice garak is a fine first scan and a poor only scan.
Citations and last verified
Verified 2026-10-17 against the garak GitHub repository and releases page, the PyPI release dates, the reference site, and a local run of v0.17.1.