AVISE: Framework for Evaluating the Security of AI Systems

1. Problem Statement

As Artificial Intelligence (AI) systems, particularly Large Language Models (LLMs), are deployed in critical domains, they face evolving security risks such as prompt injection, jailbreaking, and adversarial attacks. Current security evaluation landscape suffers from several gaps:

• Lack of Systematic Approaches: Existing tools often treat test executions as isolated events, failing to account for the stochastic nature of AI models (where single test runs yield arbitrary results).
• Limited Scope: Most tools focus on specific modalities (e.g., text or images) or static datasets, lacking flexibility for multimodal, continual learning, or complex multi-turn interactions.
• Evaluation Bottlenecks: There is a need for robust evaluation mechanisms that combine human expertise with automated language model (LM) evaluators to handle the complexity of adversarial outputs.
• Resource Constraints: Security practitioners need frameworks that allow configurable execution counts to balance statistical accuracy with computational costs.

2. Methodology: The AVISE Framework

The authors introduce AVISE (AI Vulnerability Identification and Security Evaluation), a modular, open-source Python framework designed to automate the creation and execution of Security Evaluation Tests (SETs).

Architecture

The framework consists of two primary layers:

1. Orchestration Layer: Manages the testing pipeline logic.
   • BaseSETPipeline: Abstract base classes defining the execution lifecycle (Initialize, Execute, Evaluate, Report). This ensures consistency and interoperability across different AI system types.
   • SETs (Security Evaluation Tests): Customizable classes extending the pipeline to target specific vulnerabilities (Black-box, Grey-box, or White-box).
   • Evaluators: Components that inspect target outputs. They can be static rules or dynamic Evaluation Language Models (ELMs).
   • Execution Engine: Manages configuration, resource verification, and the execution flow, allowing users to define the number of test iterations for statistical significance.
   • Report Generator: Produces human-readable reports with logs, statistical summaries, and AI-generated remediation recommendations.
2. Interaction Layer: Handles communication between the framework and target systems via Connectors (API clients), supporting black-box evaluation where internal system logic is unknown.

Case Study: The Red Queen SET

To demonstrate AVISE, the authors developed an automated SET based on the Red Queen attack (a multi-turn jailbreak technique exploiting theory-of-mind limitations).

• Augmentation: They extended the original attack by integrating an Adversarial Language Model (ALM). The ALM dynamically modifies attack prompts in real-time based on the target model's previous responses to prevent context deviation and maintain the attack trajectory.
• Evaluation: An Evaluation Language Model (ELM) (using the same Ministral 3 3B model as the ALM) automatically classifies target outputs as "Pass" (safe) or "Fail" (jailbroken/harmful).
• Test Suite: The SET comprises 25 distinct multi-turn attack templates covering scenarios like counterfeiting, crime scene cleanup, and drug smuggling, categorized by occupational and relational manipulation strategies.

3. Key Contributions

1. AVISE Framework: A modular, extensible open-source framework enabling the creation of automated SETs for diverse AI systems (LLMs, multimodal, continual learning). It supports Black-box, Grey-box, and White-box testing methodologies.
2. ALM-Augmented Attack: The development of a novel SET that uses an Adversarial Language Model to dynamically adapt multi-turn jailbreak prompts, significantly improving the success rate of attacks against stochastic models compared to static templates.
3. Automated Evaluation System: Implementation of an ELM-based evaluation pipeline that achieves high accuracy in detecting jailbreaks, reducing the reliance on manual human review for large-scale testing.
4. Empirical Validation: A comprehensive security assessment of nine recently released open-source language models of varying sizes (from 3B to 120B parameters).

4. Results

The authors evaluated nine models (including Llama 3.1/3.2/3.3, Ministral, Mistral, Qwen 3/3.5, and Nemotron) using the Red Queen SET.

• Vulnerability Findings:
  • With ALM Augmentation: All nine models were found vulnerable to the multi-turn jailbreak attack to varying degrees.
    • Most Vulnerable: Ministral 3 14B (84% failure rate).
    • Most Robust: Qwen 3.5 35B (8% failure rate) and Nemotron 3 Super 120B (12% failure rate).
  • Without ALM (Static Templates): Vulnerability dropped significantly (e.g., Ministral 3 14B dropped to 36% failure rate), demonstrating that static templates often fail due to the stochastic deviation of multi-turn conversations.
• Evaluator Performance (ELM):
  • When used with the ALM-augmented attacks, the ELM achieved 92% accuracy, an F1-score of 0.91, and a Matthews Correlation Coefficient (MCC) of 0.83.
  • Without the ALM, ELM performance degraded (79% accuracy, 0.41 F1-score) due to a high rate of false positives caused by irrelevant conversation drift.
• Statistical Rigor: The framework successfully utilized binomial proportion confidence intervals (95% CI) to validate the reliability of the failure rates across multiple test runs.

5. Significance and Implications

• Bridging the Research Gap: AVISE addresses the lack of standardized, automated tools for evaluating emerging AI modalities beyond simple text generation.
• Industry Application: The framework provides a concrete mechanism for "Red Teaming" in the AI development lifecycle, allowing practitioners to identify and patch vulnerabilities before deployment, aligning with regulations like the EU AI Act.
• Methodological Advancement: The study proves that dynamic, ALM-augmented attacks are necessary to effectively test modern LLMs, as static prompts often fail against the models' stochastic nature.
• Dual-Use Consideration: The authors acknowledge the dual-use nature of the tool (potential for malicious exploitation) but argue that responsible disclosure practices and the necessity of defenders having sophisticated tools outweigh the risks of stagnation in security research.

Conclusion: AVISE represents a significant step toward rigorous, reproducible, and automated AI security evaluation, demonstrating that current state-of-the-art language models remain susceptible to sophisticated multi-turn adversarial attacks.