Skip to content

Architecture: Deep Dive

Mutant-AI is built on a transparent, modular architecture to give developers absolute confidence in how data is generated and how systems are tested.

The Core Philosophy

Python coordinates; LLMs generate. Mutant relies on Python to predictably orchestrate complex pipelines, manage concurrency, and handle structured evaluation. However, the heavy lifting of reasoning, generating, and mutating text is entirely delegated to Large Language Models via a standardized Provider API.

The Dual-Engine Architecture

Mutant features two distinct engines, both sharing the same core dimensions and provider interfaces, but serving two different testing paradigms:

  1. Mutation Engine: (Static Generation) Explodes seed scenarios into massive behavioral datasets.
  2. Red Team Engine: (Live Agentic Testing) Actively probes live AI systems using a hypothesis-driven loop.
graph TD
    User([User]) --> |Seed Scenario| ME[Mutation Engine]
    User --> |Live Endpoint| RT[Red Team Engine]

    ME --> |Generates| Dataset[(Behavioral Dataset)]
    RT --> |Attacks| Target[Live AI Agent]

    ME -.-> |Uses| Provider[LLM Provider]
    RT -.-> |Uses| Provider

1. The Mutation Engine (Behavioral Analysis)

The Mutation Engine operates on a gap-aware, 6-stage pipeline designed for high-fidelity generation with optimized LLM costs. We achieve trust through strict behavioral analysis, multi-candidate planning, and selective LLM-as-a-judge quality reviews.

graph TD
    A[1. Seed Scenario] --> B[2. Analyze Behavior]
    B -.-> |Builds| Cache[(Behavior Profile Cache)]
    B --> G[3. Coverage Gap Detection]
    G -.-> |Reads| State[(Coverage State)]
    G --> C[4. Candidate Planning]
    Cache -.-> C
    C --> D[5. Batch Generation]
    D --> E[6. Selective Quality Review]

    subgraph "Cost & Trust Optimization"
    B -.-> |Analyze Once, Reuse Everywhere| Cache
    C -.-> |PAIR: Score N Candidates, Pick Best| C
    E -.-> |Judge Low-Confidence & Samples Only| E
    end

How it optimizes cost and quality:

  1. Behavior Profile Cache: The engine analyzes the seed scenario exactly once. It extracts actors, goals, safety constraints, and expected failure modes into a structured BehaviorProfile, which is cached. Every subsequent generation step reuses this profile instead of sending redundant context to the LLM, dramatically saving tokens.
  2. Coverage Gap Detection: Before planning, the engine checks the current MutationCoverageState. It detects missing emotions, language styles, and edge cases, forcing the planner to prioritize unexplored territory instead of repeating itself.
  3. Candidate Planning (PAIR-inspired): Instead of accepting the first plan an LLM proposes, the engine generates multiple candidate plans per dimension. Each is scored on expected diversity, semantic preservation, and coverage gain. The engine picks the highest-scoring candidate.
  4. Batch Generation: Rather than making one LLM call per mutation, dimensions generate their entire quota of mutations in a single batched prompt, maximizing context reuse.
  5. Selective Quality Review: Instead of judging 100% of generated cases (which doubles token cost), the engine only reviews a random ~40% sample, plus any low-confidence or suspiciously short outputs. Unreviewed cases are fail-open, saving massive costs on large batches.

2. The Red Team Engine (Hypothesis Lifecycle)

The Red Team Engine is an adaptive security researcher. Instead of blindly throwing adversarial prompts at a wall, it operates on a structured Hypothesis-Driven Attack Loop with compact memory and candidate strategy selection.

graph TD
    Start[Phase 0: Target Discovery] --> |Caches| TP[(Target Profile Cache)]
    TP --> O[1. Observe State]
    O --> H[2. Form Hypothesis]
    H --> S[3. Candidate Strategy Generation]
    S --> |Scores Cost & Novelty| S
    S --> E[4. Experiment / Attack]
    E --> C[5. Collect Evidence]
    C --> U[6. Update Target Model]
    U -.-> |Compresses Learnings| RM[(Reflection Memory)]
    RM -.-> O
    U --> |Goal Not Met| O
    U --> |Goal Met| Report[Phase 2: Root Cause Analysis]

How it optimizes planning and cost:

  1. Target Profile Cache: Initial black-box discovery (architecture, tools, memory) is cached in a TargetProfile. The planner consumes this to avoid testing irrelevant vulnerabilities (e.g., ignoring RAG poisoning if the target has no database).
  2. Candidate Strategy Generation: The planner generates multiple candidate attack strategies. Each strategy is scored based on expected success, novelty, and estimated cost. Cheaper, higher-confidence strategies are prioritized over expensive blind exploration.
  3. Reflection Memory (Reflexion-inspired): Instead of feeding the entire, growing conversation history back into the LLM on every turn (which causes massive token explosion), the engine compresses each turn's learnings into a ReflectionMemory. This compact memory explicitly tracks which strategies worked, which partially worked, and which definitively failed.
  4. Smart Avoidance: The planner reads the ReflectionMemory and explicitly refuses to re-attempt failed strategies unless new evidence changes its confidence. This completely eliminates the "stuck in a loop" failure mode common to naive agents, significantly reducing wasted LLM calls.
  5. Full Transparency: Every hypothesis, evidence tag, and confidence score is meticulously logged and exposed in the final RedTeamReport, providing a fully auditable trail of the attacker's reasoning.