AI red teaming & LLM evaluation
TextAttack is an open-source NLP adversarial attack framework from QData. It is released under the MIT license and is offered as: CLI, Library.
Best for
TextAttack comes out of 2020 NLP security research: it changes words and characters until a text classifier or translation model gives a different answer, a different threat from prompt injection against a chat model. The QData team's paper split every attack into a goal function, constraints, a transformation and a search method, and shipped 16 published attacks in that form. The docs now list 24 recipes, including two for sequence-to-sequence models and recipes for French, Spanish and Chinese. The same parts drive data augmentation and adversarial training, so one library can attack a model and then retrain it on the results. Pick it for classic NLP models, ART for image or tabular models, and garak for chat LLMs. It is MIT licensed and installs with pip; the repository has no security policy.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L4 Testing Testing and red teaming | Primary | Attack and evaluate models, apps and agents on purpose, before release and after every change, to find what the other layers miss. | Follows its category, AI red teaming & LLM evaluation |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
No OWASP LLM risk is mapped to this tool in our analysis.
More in AI red teaming & LLM evaluation, ranked within the category by Coverage Score.
NVIDIA
Probes language models and LLM apps for prompt injection, jailbreaks, data leakage and more.
Best for: Teams that want a free command-line scanner they can point at any model or LLM endpoint before release
Reviewed
Giskard AI
Generates adversarial test suites for LLM agents and RAG apps, runs them and reports failures by threat type.
Best for: Python teams that want a free library to scan an LLM agent or RAG app for prompt injection and harmful output, and to write pass or fail checks for it
Reviewed
OpenAI (Promptfoo)
Runs evals and red team scans against LLM apps from a CLI or CI pipeline and writes a vulnerability report.
Best for: Developer teams that want one open-source CLI for both prompt evals and red teaming, run locally and in CI
Reviewed
Yes. TextAttack is released under the MIT license, and the code is on GitHub at QData/TextAttack.
The README describes a Python framework for adversarial attacks, data augmentation and model training in NLP, with attacks assembled from four components.
The README describes attacks on NLP models and a prompt augmentation pipeline that can send augmented prompts to an LLM. It does not mention prompt injection or jailbreak testing, so see the alternatives listed on this page for that use case.
The 2020 paper implements 16 attacks from the literature. The current docs list 24 attack recipes, such as TextFooler, DeepWordBug and BERT-Attack, plus MORPHEUS and Seq2Sick for sequence-to-sequence models and recipes for French, Spanish and Chinese.
TextAttack is released under the MIT license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
TextAttack is offered as: CLI, Library.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for TextAttack: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Latest release of TextAttack: August 14, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with QData.