NVIDIA garak is the leading open-source LLM red-teaming framework. It runs probes — encoding tricks, persona attacks, jailbreaks, output poisoning — against a target LLM and reports which attacks succeeded. garak is for pre-deployment validation: "before we ship this model, what attacks work against it." It does not run in production traffic.
ATR is the runtime detection layer. Once an LLM is deployed in an agent, ATR rules inspect every prompt, every tool call, every retrieved document, every model output for known attack patterns. ATR runs at sub-millisecond per rule and blocks or alerts in real time. The two tools complement each other: garak finds what the model is vulnerable to, ATR catches when attackers actually try it.