feat(airt): model-extraction & membership-inference attack generators (#104)

* fix(ai-red-teaming): import get_generator in generated agentic script

Same missing-import bug as the ATLAS template (#100), in the separate
`_build_agentic_imports`: generated agentic-attack scripts call
get_generator (proxy-routing block) but never imported it, raising
NameError at runtime. Add the import and a TestAgenticGeneration
regression test (the agentic generator was previously untested).

* feat(airt): add model-extraction & membership-inference attack generators

Adds generate_extraction_attack and generate_membership_attack to attack_runner.
They build workflow scripts that construct a PredictionTargetSpec from a target's
predict endpoint (or an environment challenge_url) and run the SDK's extraction
(equation_solving/jacobian/copycat/knockoff) or membership (threshold/label_only)
attacks under an Assessment, exporting airt spans to the platform.

Verified: a generated knockoff-extraction workflow ran against a live fraud target
(fidelity 0.93, 500 queries) and completed its assessment on the local platform.

* feat(airt): expose extraction/membership attacks as agent tools

Add generate_extraction_attack and generate_membership_attack @safe_tool wrappers so
the AIRT agent (and TUI) can run the new traditional-ML privacy attacks, mirroring the
existing generate_image_attack wrapper over the attack_runner generators.

* feat(airt): add model-evasion attack generator and bump to 1.9.0

Wire the boundary (numeric L2/Linf decision search) and text (token-flip)
evasion attacks into the workflow runner and expose generate_evasion_attack
as an agent tool. Bump capability to 1.9.0 and note traditional black-box ML
coverage (extraction, membership inference, evasion) in the description.

* feat(airt): add deepwordbug evasion strategy to generator

* feat(airt): expand traditional-ML attack roster to 1.10.0

Register the new named attacks in the generator dispatch maps: evasion
(hopskipjump, simba, square, zoo, textfooler), extraction (activethief,
distillation), and membership (lira, shadow_model, entropy, loss).

* docs(airt): advertise new attack types in generator tool descriptions

Update the attack_type parameter descriptions so the agent surfaces the new
evasion (hopskipjump/simba/square/zoo/textfooler), extraction (activethief/
distillation), and membership (entropy/loss/shadow_model/lira) options.

Author: rdheekonda

capabilities/ai-red-teaming/capability.yaml

@@ -1,16 +1,18 @@
 schema: 1
 name: ai-red-teaming
-version: "1.9.0"
+version: "1.10.0"
 description: >
   Probe the security and safety of AI applications, agents, and foundation models.
   Orchestrates adversarial attack workflows to discover vulnerabilities in LLMs,
   agentic systems, MCP servers, multi-agent architectures, RAG pipelines, IDE/code
   agents, and custom AI endpoints before they are exploited. Covers jailbreaking,
   prompt injection, data exfiltration, tool manipulation, reasoning attacks, guardrail
   bypass, and more — mapped to OWASP LLM Top 10, OWASP ASI01-ASI10, MITRE ATLAS,
-  and NIST AI RMF compliance frameworks. 45 attack algorithms (41 LLM + 4 adversarial
-  ML samplers), 500+ transforms, an extensive scorer catalog, and 260 bundled harm
-  goals across 25 sub-categories in safety, security, and agentic tiers.
+  and NIST AI RMF compliance frameworks. Also probes traditional black-box ML
+  classifiers: model extraction (model stealing), membership inference (training-data
+  leakage), and model evasion (adversarial examples) across tabular, image, and text.
+  500+ transforms, an extensive scorer catalog, and 260 bundled harm goals across 25
+  sub-categories in safety, security, and agentic tiers.
 
 agents:
   - agents/