← Safety

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

English summaries and interface labels are available. Detailed source notes below are currently in Chinese.

模型与开放条件Model & openness

它自己不带模型，被测面是别人的模型或应用：仓库首页把 generators 定义成「plugins for LLMs to be probed」， 点名的接入有 hugging face hub generative models、replicate text models、openai api chat & continuation models、 aws bedrock foundation models、litellm，并补一句「pretty much anything accessible via REST」。 文档首扫示例是 --model_type huggingface --model_name gpt2。全部 generator 类型与各家参数差异：未逐条清点。

It ships no model of its own — the thing under test is somebody else's model or application: the repository front page defines generators as "plugins for LLMs to be probed", and names hugging face hub generative models, replicate text models, openai api chat & continuation models, aws bedrock foundation models and litellm, adding "pretty much anything accessible via REST". The documentation's first-scan example is --model_type huggingface --model_name gpt2. The full generator list and per-provider parameter differences: not itemised.

运行位置Where it runs

本机 Python 进程、终端交互：README 的安装命令是 python -m pip install -U garak，PyPI 记 pip install garak、 requires-python 为 >=3.11；文档「Setting up」页同样把它描述成命令行工具。扫描请求按你选的 target 发往云端 API 或本机推理端点。是否存在托管执行面与 Docker 镜像口径：本批次未取到官方正文，记未知。

A local Python process with a terminal interface: the README install command is python -m pip install -U garak, PyPI records pip install garak with requires-python >=3.11, and the "Setting up" doc page likewise describes a command-line tool. Scan requests go to the target endpoint you pick — a cloud API or local inference. Whether a hosted execution surface exists, and the official Docker story: no official text captured in this pass, recorded as unknown.

本地文件Local files

读的是随包安装的探针数据集与本机配置，写的是本地结果文件：README 记结果落 JSONL、garak.log 与 hit log； 文档「Our Features」列四类输出 Screen output、Report log、Hit log、Debug log。默认目录名、文件保留与清理规则： 本批次未逐字核验。

It reads the probe datasets installed with the package and your local configuration, and writes local result files: the README records JSONL, garak.log and hit logs; the "Our Features" doc page lists four output kinds — Screen output, Report log, Hit log, Debug log. Default directory names, retention and cleanup rules: not verified word for word in this pass.

关机后的任务Tasks after shutdown

没有「关机后续跑」的托管任务：一次扫描是一个本机进程，跑完写日志。文档目录列出 Setting up、Your first scan、 Getting help 等条目，未出现断点续跑或队列语义。批量任务的并行与限流方式：本批次未取到官方正文。

There is no "keeps running after you shut down" hosted task: one scan is one local process that writes logs when it ends. The docs table of contents lists Setting up, Your first scan and Getting help, with no resume or queue semantics. How batch runs parallelise and throttle: no official text captured in this pass.

工具与扩展Tools & extensions

四类插件面（README 原文短语）：probes「classes for generating interactions with LLMs」、 detectors「classes for detecting an LLM is exhibiting a given failure mode」、harnesses「classes for structuring testing」、 generators 负责接模型。点选形式见文档示例 --probes lmrc.Profanity，--list_probes 可列探针。 MCP 接入方式：官方文档未说明，记未知。

Four plugin surfaces (README's own phrasing): probes are "classes for generating interactions with LLMs", detectors are "classes for detecting an LLM is exhibiting a given failure mode", harnesses are "classes for structuring testing", and generators connect to models. Selection syntax appears in the docs example --probes lmrc.Profanity, and --list_probes enumerates probes. MCP support: not described in the official docs, recorded as unknown.

上下文与记忆Context & memory

这里的「上下文」是 harness 如何把多轮交互拼成一次探测，不是跨会话记忆。README 对 harnesses 的表述止于 「classes for structuring testing」，具体会话构造与长度策略本批次未取到逐条官方正文，记未知。

Here "context" means how a harness assembles multiple turns into one probe, not cross-session memory. The README's statement about harnesses stops at "classes for structuring testing"; the concrete conversation-construction and length strategy had no official text captured in this pass, recorded as unknown.

权限与限制Permissions & limits

许可面清楚：Apache-2.0（LICENSE 正文直读，见 license 字段）。数据流向只有一条官方可读口径——探针 prompt 与响应 发往你配置的 target 端点，失败样本逐条写进本地日志（README：「If any of the prompt attempts yielded an undesirable behavior, the response will be marked as FAIL」）。是否有默认遥测、是否上传探针结果：未取到官方声明，进 unknowns。 它不阻断线上流量，因此不存在「拦截比例」这类结论；本站也不引用任何成功率或漏检率数字。

The licence is unambiguous: Apache-2.0 (LICENSE read directly, see the licence field). There is only one readable official statement about data flow — probe prompts and responses go to the target endpoint you configured, and failing samples are written item by item to local logs (README: "If any of the prompt attempts yielded an undesirable behavior, the response will be marked as FAIL"). Whether telemetry is on by default or results are uploaded: no official statement captured, moved to unknowns. It never blocks live traffic, so there is no "what share it stops" conclusion to write; this site cites no success-rate or miss-rate figures.

适合什么任务Best for

适合：上线前对自己可控的 endpoint 批量跑一轮探针、要求留下可复核的 prompt/响应证据文件、要在 HuggingFace、 OpenAI、Bedrock、litellm 等 target 之间复用同一套探针。不适合：当运行时护栏拦用户请求；把「探针全 PASS」读成 「模型安全」（官方口径只记录失败样本，不出安全证明）；要托管报告平台或合规证书。

Fits: running a probe sweep against an endpoint you control before launch, keeping reviewable prompt/response evidence files rather than a slogan, reusing one probe set across HuggingFace, OpenAI, Bedrock, litellm and other targets. Not a fit: intercepting user requests at runtime (it does not block); reading "all probes PASS" as proof the model is safe (the official framing only records failing samples); teams needing a hosted report platform or compliance certificates.

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.