Probes, detectors, generators and buffs: the anatomy of a scanner

Up to episode seven the series works by hand: one prompt, one reply, one tester’s judgment. The eighth episode introduces the reason to stop doing everything manually. Its presenter, the creator of PyRIT, says the aim of automating is to let operators focus on the harder, more time-consuming tasks, while code handles the repetitive ones, and that code-driven workflows are repeatable, which matters because models are not always deterministic ^[1]. The Microsoft team’s 2025 paper agrees that automation helps cover more of the risk landscape, while human expertise stays essential ^[2].

The five moving parts

• Probes: the attack content. garak describes its probes as classes that generate interactions with a model to test for vulnerabilities ^[3]; Augustus calls them adversarial test cases representing specific attack patterns, covering prompt injection, jailbreaks, encoding exploits and data extraction ^[4].
• Buffs: transformations applied to prompts before they are sent. Covered below.
• Generators: the connection to the system under test. In garak they are plugins that give access to model platforms, including Hugging Face, OpenAI, local model files and anything reachable by a REST call ^[3]. Augustus has a generic REST generator for custom endpoints, configured with a URI, method, headers, request template and response parsing ^[4].
• Detectors: code that decides whether a reply shows the failure. Augustus lists pattern matching, an LLM acting as judge, the Perspective API and unsafe-content detection among them; garak’s detectors identify when a model exhibits a specific failure mode ^{[3] [4]}.
• Evaluators and reports: garak’s evaluators are reporting schemes for results. Augustus writes a table, JSON, JSONL or HTML ^{[3] [4]}.

garak’s own paper summarises the idea: it “probes an LLM in a structured fashion to discover potential vulnerabilities”, and its authors stress that LLM security is dynamic because outputs are unpredictable, models are updated constantly and adversaries are varied ^[5].

The same ideas under different names

Buffs: one idea, many variants

A buff changes the prompts a probe produces. garak’s base class says a buff “should take as input a list of attempts, and return a list of events”, and it recommends storing the origin attempt’s identifier in each derivative attempt so a result can be traced to its source ^[6]. Augustus lists seven buff transformations: encoding, paraphrase, poetry in several formats, translation into low-resource languages, and case transforms ^[4]. PyRIT’s converters do the same job, and the series gives translation and base64 as examples ^[1].

The science is the one from lesson 5. If a defence stops a request in plain English, does it also stop it encoded, paraphrased or translated? Wei et al. predict failures where safety training did not generalise to forms the model nevertheless understands, and Yong et al. measured exactly that for low-resource languages ^{[7] [8]}. A buff makes that question cheap to ask at scale. It also multiplies the work: attempts grow with the number of prompts times the number of variants times the number of generations, so plan time and cost.

A first run

Both projects document short commands. The lines below are taken from their READMEs; run them only against models you own or may test.

$ python -m pip install -U garak
$ garak --list_probes
$ python3 -m garak --target_type huggingface --target_name gpt2 --spec probes.dan.Dan_11_0

$ go install github.com/praetorian-inc/augustus/cmd/augustus@latest
$ augustus scan openai.OpenAI --probe dan.Dan_11_0 --detector dan.DAN --verbose