Red Teaming LLMs — Part 1: Engagement, Threat Modeling & Attack Craft — 42 Templates & Checklists for Authorised Engagements, LLM Threat Models, Manual Sessions & Automated Campaigns

The difference between a red teamer and a rogue employee is paperwork — precise, signed, specific paperwork. 42 production templates & checklists distilled from Chapters 1–5 of Red-Teaming LLMs: A Practitioner's Field Guide: the case for attacking your own model first, the authorisation memo and scope fences that make testing professional, the five-pass threat-modeling method and scenario register, manual session craft with its log standard, and automated campaigns whose results you can read honestly. For systems you own or are authorised to test. PDF + Markdown source.

It passed everything. Nobody had ever attacked it.

The assistant in the source book's opening story was live in production, answering a polite question with another customer's data — after passing every control its organisation knew how to run. Accuracy evaluations green. Toxicity filters tuned. A launch review with seventeen signatures. Every control measured cooperative behaviour; none of them assigned a creative human being a week, a target, and the explicit instruction: make it misbehave, and write down how. Red Teaming LLMs — Part 1 is the engagement discipline that fills that vacuum: 42 copy-paste templates and checklists distilled from Chapters 1–5 of the dedicated red-teaming field guide — define the discipline and price what adversarial behaviour costs, get permission in writing before a single adversarial prompt is typed, threat-model the system (not the model) into a scored scenario register, run manual sessions hypothesis-first with evidence a sceptical engineer can re-run, and add automation for breadth and regression without ever mistaking a green dashboard for a defended system.

Every template carries the book's tested positions built in: a six-clause definition of red-teaming with its is/is-not test, the four-discipline comparison (evaluation, penetration testing, red-teaming, monitoring — none substitutes for another), the five-beat engagement loop, an authorisation memo whose five elements are unambiguous before the window opens, a scope statement with four fences and out-of-scope written as explicitly as in-scope, the rules of engagement as a machine-checkable configuration the harness itself enforces, stop conditions with a rehearsed kill switch, a five-pass threat-modeling method whose scenarios carry TM-IDs for the life of the system, six manual technique families taught at pattern level, a session-log standard with graded verdicts and canary checks, and the four interpretive disciplines that keep an attack success rate honest. Where the book gives an example — its fictional engagement configuration (60 requests per minute, a $150 daily budget), its canary values, its detector-audit figures — the template labels it as the book's example for you to replace with your own. Bracketed fields are yours to fill; nothing here invents a threshold for your system. The book's worked estate, Meridian and its staging support assistant, is a fictional organisation, labeled fictional in the book itself. This is authorised-engagement material throughout: permission-first, scope-bound, and written for systems you own or are explicitly authorised to test, at the professional template level the book itself uses — attack techniques at pattern level only, never payload strings or exploits.

What's inside — 42 templates & checklists in 8 sections

1. Attack Your Own Model First — The Discipline, the Loop & the Case (6) — Red-Teaming Definition & Is / Is-Not Test · Four-Discipline Comparison Sheet · Five-Beat Engagement Loop & Artefacts Sheet · Risk-Ledger & Engagement-Economics Worksheet · Four Incident Archetypes Review Sheet · Objections, Framework Placement & Language-Discipline Sheet

2. Permission to Attack — Authorisation, Scope & the Engagement Contract (6) — Authorisation Memo Template · Scope Statement Template · Engagement Configuration Contract · Vendor & Platform Boundary Sheet · Kickoff Week Checklist · Special-Situations Addenda & Tester-Protection Sheet

3. Safety Rails, Evidence & Running Paper — Containing the Engagement Itself (5) — Stop Conditions & Kill-Switch Drill Sheet · Evidence Capture & Storage Standard · Accidental-Data Protocol · Ethics Lines Sheet · Running-Paper Pack

4. Know Your Battlefield — Threat Modeling the LLM Application (7) — System Anatomy Diagram Worksheet · Four-Doors Channel Ranking Sheet · Taxonomy Mapping Sheet · Five-Pass Threat-Modeling Method Worksheet · Scenario Register Template · Classification-vs-Audience Corpus Audit · Anti-Patterns, Recon & Living-Model Sheet

5. The Human Attacker — Manual Session Craft (6) — Session Anatomy Sheet · Technique-Family Planning Sheet — six families at pattern level · Escalation Discipline Sheet · Persona Design Sheet · Signal-Reading Sheet · Long-Session Formats & Sideways Protocol

6. Session Evidence — Logs, Worked Sessions, Habits & Training (4) — Session Log Standard · Worked-Session Review Sheet — the aggregation session, annotated · Session Craft Habits Sheet · New-Tester Training Exercises Sheet

7. Machines That Attack Machines — Automated Campaigns at Scale (6) — Tool-Class Selection Sheet · Campaign Design Sheet · Campaign Definition Template — the book's worked campaign, carried as printed · Honest Results Reading Sheet · Detector Calibration & Golden-Set Sheet · Probe Library, Mutation & Attack-Data Hygiene Sheet

8. Mixed Operations & the Part 1 Gate (2) — Mixed-Operations Rhythm & Comparison-Discipline Sheet · Part 1 Engagement Gate — Chapters 1–5 Sign-Off — the book's five chapter checklists consolidated into one evidence-backed gate (37 lines)

Who this is for

Security leads and AppSec engineers chartering a first LLM red-team engagement, red teamers formalising a manual practice, AI platform teams who need their launch reviews to survive the question "who was paid to make it fail?", and executives signing launch decisions who want the incident-versus-engagement arithmetic in their own numbers. The source book assumes you have, or are building, at least one LLM system that matters, basic security literacy, and no prior red-team experience — it defines its AI terms as it goes. If your organisation cannot produce, in one sitting, the signed paper that authorises adversarial testing of your flagship assistant — start at Template 7.

What this pack is not

Not Part 2. The test libraries — jailbreak and prompt-injection test design (Chapter 6), data extraction, leakage and privacy testing including canary engineering (Chapter 7), agent and tool abuse testing (Chapter 8) — plus severity scoring and metrics (Chapter 9), executive reporting (Chapter 10), the standing red-team program (Chapter 11), continuous red-teaming in the pipeline (Chapter 12), and every appendix, including the book's fill-in authorisation, test-plan and executive-report template library (Appendix C), live in the Part 2 companion pack. Nothing here restates them, and this pack is complete and useful without them. (Honest pointer, stated in the file itself: Chapter 2's prose points forward to Appendix C's fill-in versions of the memo and log — this pack carries the chapter-text versions only; the appendix library is Part 2.)

Not a payload or exploit library. Attack technique appears at pattern level only — families, structural properties, and defensive test-planning examples, exactly as the book presents them for professional defensive work. There are no jailbreak strings, no bypass recipes, and nothing aimed at systems you do not own or are not authorised to test.

Not the defense packs. The companion AI Security in Production — Part 1 pack places controls from the defender's side; Securing AI Agents — Part 1 builds agent identity, permissions, and gates; Prompt Injection — Part 1 catalogues one attack class in depth. This pack is the engagement discipline around all of them — charter, threat model, session craft, campaign discipline — and deliberately does not restate any of them.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents defense artifacts, including its general agent red-team exercise plan. This pack is the dedicated red-teaming book's deeper engagement system — memo, fences, machine-checkable RoE, log standard, detector calibration — from a different book, and does not restate it.

No tool setup or vendor guidance. The book names three open-source examples (a scanner, an orchestrator, harness-style tooling) as illustrations of its three tool classes, and this pack carries the selection and vetting discipline — never installation or configuration instructions, and no product is endorsed.

No legal advice, and no guarantee. The authorisation and retention templates are professional practice as the book presents them — the book routes legal questions to counsel, and so does this pack. And the book's own honesty position stands: a campaign samples a space; "no success observed" is a bounded claim, never a proof of safety.

Companion products

The AI Security Templates & Checklists pack is the cross-book companion — the defense slice this pack deliberately does not restate. AI Security in Production — Part 1 is the general defense companion, from the sister book. Securing AI Agents — Part 1 is the agent-defense companion. Prompt Injection — Part 1 is the single-attack-class depth companion. Red Teaming LLMs — Part 2: Jailbreak Testing, Leakage, Agent Abuse & the Standing Program is this pack's sibling, built from Chapters 6–12 of the same book plus Appendices A, B, and C: a companion for when you are ready for the test libraries, scoring, and the standing program — never a requirement for this pack to work. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Red-Teaming LLMs: A Practitioner's Field Guide, from the engagement discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Red-Teaming LLMs: A Practitioner's Field Guide, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.