[rdheekonda]

Problem (found in a live TUI session)

Asked in plain language to "run a GCG white-box attack with a local surrogate gpt2 against dn/llama-4-scout", the AI-red-teaming agent:

1. Downgraded the request to the gcg_suffix transfer transform wrapped in a TAP loop - not a real gradient attack.
2. Swapped the user's gpt2 surrogate for a dn/gpt-5.4-mini proxy model (which the SDK rejects as a white-box surrogate - no gradients over the inference proxy).
3. Told the user "true white-box GCG is not implemented in the SDK" - which is false: gcg_attack + 14 siblings are real SDK attacks, auto-discovered into _ATTACK_DEFS with requires_surrogate, and now guarded by the parity test (test(ai-red-teaming): SDK<->capability parity V&V #198).

Assessment still landed on the platform (4d4d9f06-..., ASR 0%), but the run was the wrong attack and the user was misinformed.

Root cause

The authoritative generator-picking list in <critical_instructions> had no white-box entry. Only the greeting and the whitebox-local-surrogate skill described it, so when the agent reached the routing list it improvised.

Fix

Add an explicit white-box routing rule to the list:

• White-box names (gcg, faster_gcg, i_gcg, attngcg, mask_gcg, arca, gbda, pez, cold, soft_gcg, amplegcg, refusal_ablation, soft_prompt, latentbreak, adaptive_random_search) -> generate_attack with a LOCAL surrogate as attacker_model.
• Never substitute the gcg_suffix transfer transform; never replace the user's surrogate with a dn/* proxy; never claim white-box "is not implemented."
• On the hosted sandbox (no weights/GPU), tell the user white-box needs a local/self-hosted runtime (dreadnode[whitebox]) and offer a closed-box alternative - do not silently downgrade.

Content-only change to the agent prompt; no code paths touched. The tool + skill + _ATTACK_DEFS were already correct - this makes the agent actually use them.