Select Text under Supported Target Modality when adding the target to enable text-based attacks.

File-based attacks deliver PDF or Markdown (.md) documents with malicious prompts alongside a carrier text prompt. AI Red Teaming embeds adversarial instructions in the document's text layer to test whether the target processes and acts on content extracted from uploaded files.

AI systems that ingest user-uploaded files present an attack surface that text-only scans cannot reach. An attacker can embed prompt injection instructions, system prompt extraction commands, or data exfiltration payloads in the text layer of a document. When the target processes the file, it may execute the embedded instructions and expose vulnerabilities that are not detectable through text-based testing alone.

Select Files under Supported Target Modality on the target to add file-based attacks on top of your existing text coverage to enable file-based attacks alongside text attacks. You must select Text before you can enable Files. File attacks are relevant for AI systems that accept and process uploaded documents. Common use cases include RAG applications that ingest user-uploaded files, document summarizers that process contracts or legal documents, and agents that handle file attachments such as invoices or reports.

File-based attacks apply to AI systems that accept and process uploaded documents as part of their core function. Common use cases include retrieval-augmented generation (RAG) applications that ingest user-uploaded files, document summarizers that process contracts or legal documents, and agents that handle file attachments such as invoices or reports. For these targets, file-based attacks test whether malicious content embedded in an uploaded document can manipulate the system's behavior.

Audio modality support enables red teaming of voice-enabled AI agents and speech-to-speech models that cannot be reached by text-only scans. Select Audio under Supported Target Modality on the target to enable audio-based attacks.

Audio modality attacks address two distinct risk surfaces. On the input side, adversarial audio clips can carry inaudible commands layered over noise or music, or use specific tones and accents to bypass identity controls. On the output side, generated audio may contain toxic speech, voice-cloning artifacts, or social-engineering content that text-based judges cannot evaluate. The Multi-Modal Audio Safety Judge handles output evaluation: for audio output, it transcribes the response using automatic speech recognition (ASR) before applying safety checks; for text output from an audio-input scan, it applies the existing text safety judges.