Google Cloud Rapid Agent Hackathon 2026 — Elastic Track
MUTANTE is a deterministic adversarial evaluation engine that systematically probes LLMs using mutation-based prompt transformations, producing reproducible vulnerability traces, cryptographically verifiable logs, and quantitative jailbreak confidence metrics.
Simulator: https://annatchijova.github.io/vigia/mutante.html Web: https://mutante-core-engine-430944783183.us-central1.run.app/
MUTANTE executes large-scale adversarial evaluation campaigns over target LLMs by:
- Generating structured adversarial prompt mutations (ROT13, Base64, structural and lexical transformations)
- Sending mutated inputs to target models via Vertex AI endpoints
- Capturing deterministic model responses
- Scoring interactions using a layered evaluation pipeline
- Producing reproducible vulnerability reports with cryptographic integrity
Core outputs:
- Jailbreak Confidence Score (JCS)
- Vulnerability / bypass traces
- Semantic attack clustering (via Elastic Cloud)
- Longitudinal audit logs (BigQuery)
- Cryptographically sealed execution records (SHA-256 chain)
Current LLM safety testing is manual, anecdotal, and localized. When a security researcher finds a jailbreak, it is typically a one-off event. When vendors release "safety patches," they are black-box updates that users and enterprises must trust blindly. There is no standard for quantifying model robustness, and there is absolutely no audit trail for adversarial success.
MUTANTE solves this critical industry failure. We treat every adversarial prompt as a reproducible forensic artifact. We turn the "art" of red teaming into a scientific, metric-driven diagnostic process.
For a large enterprise, the operational cost of manual, human-driven red-teaming is astronomical. It requires highly specialized human resources, scales poorly, and consumes vast amounts of time. MUTANTE addresses this bottleneck directly: it is not just a security utility; it is a capital optimization asset.
By automating vulnerability detection using an intelligent Multi-Armed Bandit model governed by Thompson Sampling, MUTANTE continuously learns which semantic mutations are actively breaking a model's specific alignment layer. Instead of wasting infrastructure budget on brute-force fuzzing or redundant test variations, the orchestrator dynamically prioritizes the exact mutation vectors that demonstrate the highest bypass success rates. This directly minimizes token consumption, slashes compute time, and concentrates testing budgets strictly on high-yield diagnostics.
The CISO & CTO Value Proposition: MUTANTE drastically reduces expenditures on manual red-teaming while simultaneously increasing diagnostic coverage and compliance depth across all corporate model deployments.
- Enterprise Asset Endorsement: Corporate security teams can leverage MUTANTE to continuously benchmark vendor-supplied LLMs or fine-tuned corporate models before shipping them to production, providing an empirical safety baseline.
- Predictive Resource Allocation: By identifying specific linguistic vulnerability profiles, security architects can direct engineering teams to optimize input system prompts or guardrails precisely where the model's defensive layers are fractured, rather than over-engineering safe boundaries.
- Audit-Ready Evidence: Security teams can generate mathematical compliance logs to satisfy rigorous internal and external corporate risk audits.
MUTANTE disrupts the current landscape by providing automated, enterprise-grade diagnostics that produce the exact artifacts the cybersecurity industry desperately needs:
- Systematic & Reproducible Red Teaming: Unlike manual pentesting, MUTANTE leverages standardized corpora (HarmBench, Agentic Security) to provide reproducible, mathematically sound metrics that can be audited and compared across different model families.
- Vector-Specific Robustness Profiles: When the full 30,000+ prompt campaign concludes, the Thompson Sampling Bayesian Bandit reveals exactly which mutation families possess the highest historical bypass rate against specific models. This granular vulnerability mapping currently does not exist publicly for next-generation architectures like Gemini 3.
- Next-Generation Guardrail Training Data: The semiotic indicators and layer matches captured during successful bypasses are pure gold for AI safety engineering teams. The unique pragmatic patterns that VIGÍA detects provide zero-day training data to patch filters before vulnerabilities are exploited in the wild.
- Cross-Model Benchmarking: By running the identical dataset through GPT-5, Gemini 3.1 Pro, and Claude 3.5, MUTANTE generates a real-world resistance matrix. This empirical comparative data is an invaluable asset in the LLM auditing market, revealing the true resistance profile that enterprise AI consumers demand before procuring a vendor.
- Capital Optimization: Automating vulnerability detection through reinforcement learning slashes compute time, minimizes API token consumption, and directs corporate security budgets strictly toward high-yield diagnostics.
During our technical audit phase, we executed a high-intensity campaign that processed a total of 1,188 probes, indexed in real-time via Elastic Cloud. The results demonstrated the model's robustness, as Gemini mitigated 99.6% of the public threat landscape, allowing MUTANTE to surgically isolate only 5 genuine bypasses, representing a 0.42% success rate. These forensic findings were specifically concentrated within the Mirror and Scramble attack families—highlighting a Mirror vector with a JCS of 2.90—thereby providing reproducible evidence that serves as a clear security roadmap for the Blue Team to prioritize the hardening of these specific vulnerabilities.
Most penetration tests target a random, brute-force subset of vector space. MUTANTE utilizes Bayesian Thompson Sampling to optimize adversarial mutation in real-time.
- The Orchestrator: It continuously learns which mutation families—Lexical Obfuscation (ROT13, Zigzag, Base64), Structural Disruption, or Pragmatic Reframing—are actively breaking a target model's specific alignment layer.
- Vulnerability Footprinting: By the time the orchestrator processes our canonical dataset, the system maps the exact vulnerability footprint of the model. This reveals precisely which semantic vectors bypass its alignment, eliminating guesswork and providing a deterministic heat map of the model's cognitive blind spots.
[ Master Dataset ]
|
v
[ Thompson Sampling Orchestrator ]
|
+----------------------+----------------------+
| | |
v v v
[ rot13 ] [ base64_encode ] [ zigzag ] ...
| | |
+----------------------+----------------------+
|
v
[ Mutated Prompt Payload ]
|
v
[ Target Model AI ]
|
v
[ Plaintext Response ]
|
v
+──────────────────────┴──────────────────────+
| |
v v
[ Deterministic Core ] [ Probabilistic Judge ]
(Rational Arithmetic) (Gemini Temperature=0)
| |
+──────────────────────┬──────────────────────+
|
v
[ Hybrid Score Fusion Layer ]
|
v
[ Bypass Quality Gate (Gate) ]
|
+──────────────────────┴──────────────────────+
| |
v v
[ Elastic Cloud Sink ] [ BigQuery Sink ]
(Real-time Analytics ES|QL) (Longitudinal Audit Layer)
Applies structured transformations to adversarial prompts:
- ROT13 encoding
- Base64 encoding
- lexical scrambling
- structural rewriting
- semantic reframing
Purpose: systematically explore adversarial prompt space under controlled transformations.
A Multi-Armed Bandit controller that:
- models mutation effectiveness as probabilistic reward distributions
- dynamically prioritizes high-yield adversarial transformations
- reduces redundant evaluation overhead
A non-stochastic evaluation engine that:
- computes interaction scores using rational arithmetic (
fractions.Fraction) - performs structured lexical and semantic matching
- enforces rule-based classification of jailbreak success signals
This layer is designed for reproducible evaluation without evaluator drift.
A zero-temperature LLM-based enrichment layer that extracts:
- Pragmatic Compliance Drift: Measures the degree to which the target model fulfilled the underlying harmful intent of the prompt, even if wrapped in non-standard phrasing.
- Semantic Accommodation: Tracks whether the model adopted the specialized terminology, tone, or forced lexicon injected by the adversary.
- Safety Boundary Erosion: Evaluates if restricted data was delivered under the guise of "educational simulations," "theoretical walkthroughs," or "historical reviews."
- Contextual Reframing Sensitivity: Quantifies the target's susceptibility to falling into hypothetical scenarios, fictional roleplays, or nested coding abstractions.
This layer is strictly separated from deterministic scoring and is used only for annotation.
A deterministic scoring function derived from observed interaction signals:
(Designed to avoid floating-point instability and ensure reproducibility.)
MUTANTE produces multi-layered observability artifacts:
- Real-time attack clustering (Elastic Cloud + ES|QL)
- Embedding-based semantic indexing (
gemini-embedding-001) - Long-term regression tracking (BigQuery)
- Structured forensic logs per interaction
- Cross-model benchmarking matrices
- Elastic Cloud: High-speed real-time ingestion layer storing high-dimensional prompt embeddings. Enables on-the-fly kNN queries and greedy cosine clustering to visualize latent attack families, driven entirely by native ES|QL aggregations.
- Google BigQuery: Long-term analytics sink tracking structural safety regressions over time via daily partitioned tables with native JSON schema structures.
MUTANTE separates evaluation into two strictly decoupled layers:
- Deterministic evaluation core (primary truth source)
- Probabilistic metadata profiler (annotation only)
This prevents circular evaluation effects where probabilistic systems are used to audit probabilistic systems without constraint separation.
Before deploying the full backend infrastructure, the best way to understand the underlying rational arithmetic is through our standalone visual lab.
File: gemini-code-mutante-simulator.html
This file is a self-contained, interactive simulator designed for quick onboarding, live hackathon demonstrations, and offline presentations. It allows safety teams and auditors to:
- Inject raw adversarial payloads and apply real-time cryptographic and semantic mutations (ROT13, Base64, ZigZag, Mirror).
- Manually manipulate the deterministic scoring sliders (Syntax, Semantic, Pragmatic layers) to observe boundary conditions and trigger points.
- Visually audit how MUTANTE calculates the continuous JCS and triggers the non-linear synergy rules.
How to run: Simply open gemini-code-mutante-simulator.html in any modern web browser. No server, database, or backend connection required.
.
├── agent_mutante/
│ ├── agent.py
│ ├── engine/
│ │ ├── __init__.py
│ │ ├── bayesian.py # Multi-Armed Bandit Thompson Sampling
│ │ ├── bigquery_sink.py # BigQuery analytics connector
│ │ ├── elastic_semantic.py # Vector space, kNN, and ES|QL layers
│ │ ├── mutante_hybrid_evaluator.py # Hybrid score fusion orchestrator
│ │ ├── mutante_semiotic_evaluator.py# Rational-arithmetic deterministic core
│ │ ├── mutator.py # Adversarial mutation transformations
│ │ ├── quality_gate.py # Statistical quality gate and noise filter
│ │ ├── sandbox.py # Secure execution environment limits
│ │ └── semiotic_llm_judge.py # Pragmatic degradation profiler
│ └── requirements.txt
├── dashboard/
│ ├── app.py # Main Streamlit view router
│ ├── components/
│ │ ├── __init__.py
│ │ ├── components_init.py
│ │ ├── css.py # Global dashboard styling sheets
│ │ └── sidebar.py # Persistent navigation sidebar
│ └── pages/
│ ├── agent_console.py # Interactive live playground sandbox
│ ├── analytics.py # Cluster analytics driven by ES|QL
│ ├── attack_families.py # PCA coordinate mapping & kNN diagnostics
│ ├── command_center.py # Real-time KPIs and system pulse dashboard
│ └── forensic_feed.py # Chronological trace log with threat tags
├── CODE_OF_CONDUCT.md
├── CONTRIBUTORS.md
├── LICENSE
├── README.md
├── deploy.sh
├── install.sh # Automated deployment suite
├── main.py # Master high-throughput batch pipeline
├── mcp_mutante.py # Native Model Context Protocol server
├── run_campaign.py # Master high-throughput batch pipeline
├── gemini-code-mutante-simulator.html # Interactive standalone lab
├── batch_results.jsonl # Output logs
├── campaign_results.jsonl # Output logs
├── harmbench_behaviors.csv # Curated behavior set
└── jailbreaks_dataset_master.csv # Consolidated master corpus
- Python 3.10 or higher.
- Linux Operating System environment (Verified natively on Linux Mint / Debian architectures).
- Valid Google Cloud Vertex AI credentials.
- Elasticsearch Cloud cluster access.
Clone and install:
git clone https://github.com/annatchijova/mutante.git
cd mutante
bash install.shinstall.sh creates a .venv, installs all dependencies, and generates a .env template. Fill in your credentials before running:
GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
VERTEX_AI_LOCATION="us-central1"
ELASTIC_CLOUD_ID="your-elastic-cloud-id"
ELASTIC_API_KEY="your-elastic-api-key"
TARGET_MODEL="gemini-3-flash"Do not use the legacy main.py for full production runs. To execute the master orchestration pipeline across the consolidated dataset (~32,000+ prompts):
python run_campaign.pyNote: Use python run_campaign.py --dry-run to preview, or python run_campaign.py --limit 500 for a capped test.
streamlit run dashboard/app.pyLaunches the Command Center on http://localhost:8501 with Forensic Feed, Agent Console, and Attack Families interfaces.
python mcp_mutante.pyIn high-stakes enterprise and legal environments, the integrity of the evidence is the only thing that matters. Inspired by the structural paradigm of VIGÍA, MUTANTE elevates LLM safety auditing to the Daubert Standard of scientific evidence. Every vulnerability report and risk index is 100% reproducible and cryptographically secure.
- Tamper-Evident Forensics: Every diagnostic iteration is indexed in Elasticsearch with a unique
raw_response_hash(SHA-256). If the raw response changes by even one byte, the audit log invalidates, ensuring your vulnerability report remains perfectly immutable. - Silent Model Drift Detection: By tracking these cryptographic hashes over time, MUTANTE is the first tool capable of detecting "silent model updates." If a model provider updates their alignment silently behind an API endpoint to patch a flaw without notifying the public, our hash mismatch provides immediate, undeniable proof of a behavioral shift.
- Chain of Custody: The mathematical combination of the Jailbreak Confidence Score (JCS), the deterministic forensic indicators, and the cryptographic seal ensures that MUTANTE reports constitute admissible, undeniable evidence for formal corporate safety inquiries.
14 Mutante Song: [https://suno.com/song/885bffa4-409d-4f81-96d2-f81a5e31d716]
Mutante Anthem: Olga Vasilieva
Manual testing is a shot in the dark, One-off exploits leaving no real mark. LLM alignment shifting in the shade, Enterprises trusting patches blindly made. But security is science, not a guessing game, We turn the red-teaming art into a metric frame. No more anecdotal safety, no more silent drift, It’s time to give the AI defense a massive shift.
MUTANTE! The deterministic core! Probing the boundaries, knocking down the door. Mutation engines breaking through the alignment layer, Continuous diagnostics, the ultimate gainsayer! We calculate the JCS, we seal the audit trail, MUTANTE’s running campaigns so safety will not fail!
Base64, ROT13, structural design, Thompson Sampling optimizing the mutation line. We don't waste the token budget on a brute-force run, The Bayesian Bandit knows exactly how the bypass is won. From Elastic Cloud sinks to BigQuery track, We map the cognitive blind spots when the models crack. Cryptographic hashes, SHA-256 bound, Every vulnerability trace is solid and profound.
MUTANTE! The deterministic core! Probing the boundaries, knocking down the door. Mutation engines breaking through the alignment layer, Continuous diagnostics, the ultimate gainsayer! We calculate the JCS, we seal the audit trail, MUTANTE’s running campaigns so safety will not fail!
This is capital optimization for the C-Suite view, Slashed budgets, deep compliance, insights clean and new. To the Daubert Standard of evidence we strictly hold, Turning chaotic prompts into forensic gold.
No more blind trust. No more silent updates. Deterministic. Verifiable. Reproducible. MUTANTE. The future of AI diagnostics is here.
Semantic Family:
Successful Bypasses:
Vulnerability Roadmap (Detected Bypasses):
We acknowledge the following datasets and frameworks that provided baseline open-source adversarial sequences:
- Agentic Security (
msoedov/agentic_security) — foundational insights into agentic attack vectors and fuzzing corpora. - HarmBench (Center for AI Safety) — standardized frameworks for evaluating adversarial robustness.
- WildChat-1M (Allen Institute for AI) — large-scale real-world user-model interaction data.
License: Apache License, Version 2.0.
Authors: Anna Tchijova, Gemini.