DECK
攻击牌组Attack deck
越权、泄密、诱导分别覆盖不同滥用目标。Authorization, exfiltration, and manipulation cover distinct abuse goals.
01 ·
换了一把锁，昨天撬开的那扇窗还需要再试吗01 · After replacing a lock, do you still retest yesterday's open
window?
团队修补了泄密攻击，却没有重跑上周的越权案例。新补丁会不会挡住一类攻击，同时重新打开另一条旧路径？The team patches an exfiltration attack but never reruns last week's authorization cases. Could the patch close one path while reopening another?
02从越权、泄密、诱导牌组出题，在攻击树中定位穿透层并完成修补复测Play Authorization, Exfiltration, and Manipulation Cards, Trace Penetration, Then Patch and Retest
攻击牌组 · 穿透树attack deck · penetration tree
状态 AMetric A
—
—
状态 BMetric B
—
—
状态 CMetric C
—
—
所有概率、分数、成本、token 与输出均为固定种子的教学模拟，不代表真实模型输出。把主变量拖回即可复核结论。All probabilities, scores, costs, tokens, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.
03把刚才的变化拆成 4 个零件Break the Change into Four Parts
Red TeamingTREE
攻击树Attack tree
从入口到资产逐层显示通过、阻断或穿透。Each layer from entry to asset shows pass, block, or penetration.
PATCH
定点修补Targeted patch
修补必须对应已确认的穿透层。A patch must address the confirmed penetrated layer.
RETEST
回归复测Regression retest
修补后重跑当前与所有旧攻击，才能恢复发布资格。After a patch, rerun the current and every prior attack before restoring release eligibility.
04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction
MECHANISM
release_ready = patched ∧ retest(current ∪ prior_attacks) =
pass
修补只改变代码状态，不自动改变证据状态；必须复测当前攻击和历史攻击集。A patch changes code state, not evidence state. The current
attack and the historical attack set must be rerun.
选择攻击牌Choose attack card攻击树展开expand attack tree
定位穿透层Locate penetration实施修补apply patch
重跑旧攻击Rerun old attacks恢复证据restore evidence
05修补泄密路径后跳过历史攻击复测Patch Exfiltration and Skip Historical Attack Retests
主动制造失败Create a failure边界实验Boundary experiment
“已经修了”不是安全证据。缺少旧攻击回归时，发布状态必须保持阻断。Patched is not safety evidence. Without historical regression tests, release status must remain blocked.
尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction
first.
✗ 正常样本全过就证明系统安全。Passing normal cases proves safety.→ ✓ 恶意输入需要独立对抗测试。Malicious inputs require separate adversarial
testing.
✗ 修补当前攻击就可删除旧牌组。Patching the current attack retires old
cards.→ ✓ 旧攻击必须成为永久回归集。Prior attacks must become a permanent regression
set.
✗ 攻击树只要标最终失败即可。Only the final failure needs marking.→ ✓ 穿透层决定补丁位置和复测范围。The penetration layer determines patch location and retest
scope.
06 · 一句话带走06 · One line to keep