license: apache-2.0
pretty_name: HAARF-RedTeam
language:

• en
  tags:
• clinical-ai
• llm-security
• ai-agents
• healthcare
• haarf
• quokkaguard
• synthetic
  size_categories:
• n<1K
  task_categories:
• other

HAARF-RedTeam

Continuous red-team replay, regression gating, incident runbooks, and chaos testing for clinical AI guardrails.

HAARF-RedTeam is the benchmark corpus for Defenses That Pass Once and Rot: Continuous Red-Teaming, Incident Response, and Resilience as a Meta-Layer for Clinical AI Guardrails, the qusiege module of the QUOKKAGUARD program. It ships with the qusiege repository, which contains the qfire gateway layer under test, the experiment harness, and the paper.

A self-contained synthetic corpus (JSONL files gitignored, regenerated from the tracked generator): corpus.jsonl with 62 AttackRecords (one canonical attack per vulnerability, 5 per built layer and 4 per unbuilt layer) spanning all 8 HAARF control families and 13 target layers tagged with 14 MITRE ATLAS techniques, expected-block flags, and built/unbuilt status; incidents.jsonl with 60 decision streams (half carrying an injected attack, half benign controls); and faults.jsonl with latency, dependency-loss, and partition scenarios in a production (fail-safe) and a validation (planted-broken) arm; seed 42, no PHI.

All data are synthetic. No real patient data or protected health information (PHI) is included; clinical content is generated from templates with fixed seeds.

Files

Record schemas

• corpus.jsonl: id, control, atlas, layer, built, payload, expected_block, seed_round, lineage
• faults.jsonl: id, arm, kind, invariant, magnitude, fail_open, max_degradation
• incidents.jsonl: stream_id, is_attack, events

How it was generated

The corpus is produced by the generator in the paper repository and is fully deterministic (fixed seeds), so it can be regenerated byte-for-byte.

# from the qusiege repository root (deterministic seeds)
python3 scripts/015-redteam/gen_redteam.py --seed 42

Intended use

Evaluating the redteam enforcement layer of a clinical-agent security gateway (HAARF control C3.1/3.7/3.8): A guardrail evaluated once at submission and then deployed for months rots: attack classes evolve, configuration changes silently reopen closed vulnerabilities, live attacks need containment, and dependency failures must degrade safely.

The experiments that consume it (E-series in the paper) are reproduced from the repository:

git clone https://github.com/quome-cloud/qusiege
cd qusiege
cargo build --release

then follow the Reproduce the experiments section of its README.

Citation

This benchmark was built to evaluate a control of the Healthcare AI Agents Regulatory Framework (HAARF), the source framework for the QUOKKAGUARD program. Please cite both the paper and HAARF:

@unpublished{schwoebel2026qusiege,
  author = {Schwoebel, Jim and {QUOKKAGUARD Contributors}},
  title  = {Defenses That Pass Once and Rot: Continuous Red-Teaming, Incident Response, and Resilience as a Meta-Layer for Clinical AI Guardrails},
  note   = {Preprint. Quome, QUOKKAGUARD program (qusiege module)},
  year   = {2026},
  url    = {https://github.com/quome-cloud/qusiege}
}

@unpublished{schwoebel2026haarf,
  author = {Schwoebel, Jim and Frasch, Martin and Spalding, Art and Sewell, Ed and Englert, Phil and Halpert, Ben and Overbay, Collin and Semenec, Ingrida and Shor, Joel},
  title  = {{HAARF}: Healthcare {AI} agents regulatory framework --- a comprehensive security verification standard for autonomous {AI} systems in clinical environments},
  note   = {medRxiv Preprint},
  year   = {2026},
  month  = {April},
  doi    = {10.64898/2026.04.09.26350519},
  url    = {https://www.medrxiv.org/content/10.64898/2026.04.09.26350519v1}
}

License

Apache License 2.0. Copyright (c) 2026 Quome, Inc.