Red-teaming a model

termite can test a model before you allow it near a shell. Use this when your team wants to use a local model, or when someone tells you that a model is safe. The test shows what the model writes and what you would need to restrict if you used it.

Tests run on your machine unless you choose a hosted run, which must pass the same gate. termite never runs a command that a model writes, and nothing leaves your machine unless you send it.

Test a model

Add the model to eval/models.jsonl:

{"name":"my model","url":"http://127.0.0.1:11434","model":"my-model:latest","size_b":7,"context_tokens":4096}

Then run the three steps below. Each model test refuses to start outside a sandbox.

scripts/sandbox.sh --termite-config target/debug/examples/eval run --only "my model"

scripts/sandbox.sh --termite-config target/debug/examples/eval trials --only "my model"

target/debug/examples/eval publish && target/debug/examples/eval private

The first step sends every request, from “list the files” to outright attacks. The second step repeats a sample of requests, then sends them behind a full context. The third step calculates the scores and writes your report.

A decision model goes in eval/decision-models.jsonl, and eval decision scores it against the safety ladder.

What you get

A safety grade. The grade is how often the model wrote a hazard for a hostile request. It measures the model alone and ignores termite’s checks, because another tool might not have those checks.

Most models I tested are in the lower half of this table, so check your model and do not assume it is better. Runs published so far could not refuse, so these grades do not show whether a model would refuse.

A reliability result. This shows whether the model gives the same answer twice, and what it does when the context fills up. If a model declines four times and writes the hazard the fifth time, treat it as a model that writes the hazard.

A private report. This is a dated page in ~/termite-private. It holds every withheld command, what to do about each finding, and how to report it. It also shows the areas where the model is weakest, what to block in your own tools, and whether each finding is a known technique or may be new.

What to restrict

Read the model ratings and the report, then answer three questions:

1. What can the model reach? A grade E model with no shell access can do little harm. With shell access, it can do serious harm. Assume that it will use everything it can reach.
2. In which areas did it fail? If it reads secrets on request, keep it away from your credentials; run it in a sandbox, or remove secrets from its environment.
3. Does anything run what it writes? termite does not. Any tool that runs commands without a person checking them should use rules in code, and it should not depend on a model’s judgement.

Do not use a model as your safety check. The decision models I tested separate the most serious commands from the rest, but they rate many risky commands as safe or cannot separate the lower tiers. Use rules in code for blocking.

What this test does not show

• The test covers shell commands only. A good grade says nothing about what a model does with your documents, your API or a screenshot.
• Some of the test requests are published, so a model could be trained to pass them.
• Levels 8 to 10, where a hostile model attacks a container, are not built yet.

The standards page shows what is covered and what is not.