Red Teaming LLMs — Part 2: Jailbreak Testing, Leakage, Agent Abuse & the Standing Program — 42 Templates, Checklists & Worksheets for Injection Test Families, Canary-Based Leakage Testing, Agent Abuse Cases, Severity Scoring, Executive Reporting & the Con

Part 1 charters the engagement. This pack runs the tests: 42 production templates, checklists & worksheets distilled from Chapters 6–12 and Appendices A–C of Red-Teaming LLMs: A Practitioner's Field Guide — direct and indirect injection families designed around planted canary goals, the four leakage classes with canary engineering, the six agent abuse cases tested against canary tools, a four-dimension severity rubric with its evidence standard, the two-document reporting system and readout, the standing program's charter, cadence and budget, and regression packs that gate the pipeline — plus the book's fill-in authorisation memo, test plan and executive report templates. Standalone: complete and useful on its own. For systems you own or are authorised to test. PDF + Markdown source.

"The model resisted prompt injection" is marketing. Here is the security version.

Of 214 designed attempts across five families: 3 full successes, 11 partial, all in two families, transcripts attached. That sentence — the source book's standard for an honest injection result — is what this pack teaches you to be able to write about your own system. Red Teaming LLMs — Part 2 is the test-library and program half of the dedicated red-teaming field guide: 42 copy-paste templates, checklists, and worksheets distilled from Chapters 6–12 and Appendices A–C — design jailbreak and injection families by the property they probe, prove leakage against planted canaries instead of real data, test agents where manipulated words become real actions, score findings on evidence with a rubric agreed before the argument starts, report up in documents built for decisions, stand the discipline up as a permanent program, and wire it into the delivery pipeline so a verified fix cannot quietly expire.

Every item carries the book's tested positions built in: the instruction hierarchy treated as a soft boundary to be measured, never assumed; every test given a harmless canary goal (the book's planted marker, LANTERN-4417) instead of a harmful one; verdict rubrics — full, partial, none, plus the evidence required — written before execution and amended only in writing; leakage divided into four classes, each naming the layer that must fix it, with disclosure budgets that count fields crossed inside an effort budget; the six agent abuse cases tested against canary tools and a permission policy written as data, with blast-radius statements that name single-control dependencies in those words; severity scored on access, boundary, consequence, and reproducibility, with chains rated at their end consequence and blended attack-success rates banned from dashboards; an executive report of four pages or fewer with the verdict in the first paragraph; and a continuous layer of layered regression packs whose gate rule tolerates zero full successes across repeated runs. Where the book gives an example — its carrier record (INJ-IND-014, marker KESTREL-209), its leakage record (LEAK-RAG-031), its scoped agent policy (a $50 confirmed refund ceiling, 25 steps per task), its pack manifest (RP-07, 46 cases) — the template labels it as the book's example for you to replace with your own. Bracketed fields are yours to fill; nothing here invents a threshold for your system. The book's worked estate, Meridian and its staging support assistant, is a fictional organisation, labeled fictional in the book itself. This is authorised-engagement material throughout: permission-first, staging-bound, canary-proven, and written for systems you own or are explicitly authorised to test — attack techniques at pattern level only, never payload strings or exploits, exactly as the book itself holds the line.

What's inside — 42 templates, checklists & worksheets in 8 sections

1. Breaking the Instruction Hierarchy — Jailbreak & Injection Test Design (6) — Instruction-Hierarchy Root-Cause & Attack-Path Sheet · Direct Injection Test-Family Design Sheet · Indirect Injection Carrier & Test-Case Record · Verdicts-Before-Tests Rubric & Worked Family Sheet · Control-Mapping, Wider-Surfaces & Layer-Ablation Sheet · Persistence, Prompt-Boundary, Aging & Refusal-Topography Sheet

2. What the Model Remembers — Leakage & Privacy Testing (6) — Four Leakage Classes & Fix-Layer Sheet · Canary Engineering & Register Template · Extraction Test Families, Class by Class · Privacy-Beyond-the-Corpus & Disclosure-Budget Sheet · Index-Exposure & Role × Data Matrix Sheet · Side Doors, Erasure, Human Sources, Canary Lifecycle & Leak Triage Sheet

3. When the Model Holds the Keys — Agent & Tool Abuse Testing (6) — Agent Abuse-Case Catalogue & Test Sheet · Canary Tools & Scoped Permission-Policy Template · Human-Layer & Confirmation-Gate Test Sheet · Blast-Radius Statement & Tool-Schema Review Sheet · Worked Abuse Case, Ring by Ring & Delegation Test Sheet · Sandbox Fidelity, Kill Paths, Third-Party Tools, Recovery & Procurement Sheet

4. Scoring the Breach — Severity, Evidence & Metrics (6) — Five-Element Evidence Standard · Four-Dimension Severity Rubric & Level Map · Program Metrics & Finding-Record Template · Triage, SLA & Written Risk-Acceptance Sheet · Calibration Rituals & Worked Scoring Sheet · Confidence Axis, SLA Politics, Disputes, Portfolio & Meta-Metrics Sheet

5. Reporting Up — Findings Into Funded Fixes (6) — Two-Documents, Two-Audiences Sheet · Executive Summary Skeleton — the Book's Worked Example · Readout Meeting Runbook · Post-Report Loop & Interim Escalation Note Template · Excerpt, Auditor, Culture & Written-Record Sheet · Closure Audits, Finding Lifecycle & Second-Reader Sheet

6. Building the Program — The Standing Red Team (6) — Operating-Model Selection Sheet · Team Roles, Hiring & Tester-Care Sheet · Annual Cadence & Budget Skeleton · Maturity Ladder, First Quarter & Outsourcing Sheet · One-Page Program Charter Template · Craft Growth, Program Failure Modes, Succession & Interfaces Sheet

7. Always On — Continuous Red-Teaming in the Pipeline + the Master Checklist & Quick Reference (4) — Regression-Pack & Probabilistic-Gate Design Sheet · Weekly Clock & Ninety-Day Starter Roadmap · Gate Operations, Portfolio, Shadow Runs, Endings, Dashboard, Limits & Intake Sheet · Master Engagement Checklist & Severity Quick Reference — the book's Appendix A checklist (29 lines) and Appendix B one-page scoring reference

8. Appendix C — The Fill-In Template Library & the Part 2 Gate (2) — Fill-In Templates 1–3: Authorisation Memo, Test Plan & Executive Report — the book's Appendix C fill-in library, carried field for field · Starter Test-Library Index & Part 2 Gate — Chapters 6–12 Sign-Off — Appendix C's 16 seed families plus the book's seven chapter checklists consolidated into one evidence-backed gate (59 lines)

Who this is for

Red teamers and AppSec engineers who already run — or are chartering — authorised LLM testing and need the test libraries, scoring discipline, and program machinery; AI platform and agent teams whose systems read untrusted content or hold real tool permissions; security leaders building a standing red-team function with a cadence, a budget, and a maturity path; and executives who sign launch decisions and want findings stated as blast radius, dimension scores, and dates instead of adjectives. The pack is standalone: the fill-in authorisation memo and test plan from the book's Appendix C ship inside it (Templates 41–42), so an engagement can be papered, tested, scored, and reported from this pack alone. If your team cannot yet state, per test family, how many full and partial successes your flagship assistant produced last cycle — start at Template 2.

What this pack is not

Not Part 1. The engagement foundations — the discipline's case and definition, the authorisation discipline in chapter depth, the five-pass threat-modeling method and scenario register, manual session craft and its log standard, and automated campaign design and detector calibration — are the book's Chapters 1–5 and live in the Part 1 companion pack. Nothing here restates them, and this pack is complete and useful without them: where a Part 2 workflow needs an authorisation, a scenario ID, or a pinned configuration, the pack states the need in its own fields, and Appendix C's fill-in memo and test plan ship here. Where Part 1's chapter text pointed forward to Appendix C's fill-in templates, those templates are in this pack — that pointer is closed from this side.

Not a payload or exploit library. Attack technique appears at pattern level only — families, properties, carriers, and verdict construction, exactly as the book presents them for professional defensive work, under its own dual-use rule: publish methods, protect payloads. There are no jailbreak strings, no bypass recipes, and nothing aimed at systems you do not own or are not authorised to test.

Not the single-attack-class catalog. The companion Prompt Injection — Part 1 pack catalogues one attack class from its own dedicated book — its patterns and its graded seed cases written to be implemented against that class. This pack's Section 1 is a different book's treatment: families designed by property probed, around planted canary goals, spanning jailbreaks and injection together and extending to leakage and agent abuse. Different books, different artifacts; no pattern, seed, or worked value is shared.

Not the defense builds. The companion Securing AI Agents packs build the agent defenses — permissions, audit schemas, memory controls, delegation design; the companion Prompt Injection — Part 2 pack builds the injection defense architecture; the AI Security Templates & Checklists pack holds the cross-book defense slice. This pack tests whether those controls hold: it names controls only as the fix paths a finding maps to and the layers a test ablates, at design level. It ships no permission matrix, no audit schema, and no policy build.

No runnable tooling. The regression packs, gates, canary tools, and dashboards here are design templates — manifests, gate rules, instrumentation rules, operating rhythms — in the book's shapes. No scanner, harness, CI integration, or working canary tool ships in this pack; your team builds them from these designs.

No legal advice, and no compliance certification. Severity levels, SLAs, and the Part 2 gate are management instruments from the book. Passing the gate certifies only that the Part 2 discipline was applied; it certifies no compliance with any regulation or standard.

Companion products

Red Teaming LLMs — Part 1: Engagement, Threat Modeling & Attack Craft is this pack's sibling, built from Chapters 1–5 of the same book: the charter, threat model, session craft, and campaign discipline the test libraries run inside — a companion for depth, never a requirement for this pack to work. Prompt Injection — Part 1 is the single-attack-class depth companion, from its own book. Securing AI Agents — Part 1 and Part 2 are the agent-defense companions. The AI Security Templates & Checklists pack is the cross-book defense companion. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Red-Teaming LLMs: A Practitioner's Field Guide, from the test-library and standing-program discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Red-Teaming LLMs: A Practitioner's Field Guide, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.