| Tier | Tools | Description |
| Tier 1 | WormGPT, FraudGPT, EvilGPT, WolfGPT, PoisonGPT, DarkBERT, DarkBART | Purpose-built malicious models. Fine-tuned on malware/cybercrime data. |
| Tier 2 | Code Llama uncensored, Dolphin, LLaMA uncensored | Open-source with alignment removed. No subscription. |
| Tier 3 | Jailbroken GPT-4, jailbroken Claude | Commercial models via prompt injection. Near-zero barrier. |
| # | Subsystem | Function |
| 01 | HUNTER | Dark web scanning — forums, Telegram, GitHub, paste sites. Signature-based detection. |
| 02 | SENTINEL | Internal monitoring — jailbreak prompts, uncensored models, AutoGPT, voice clones, polymorphic malware. |
| 03 | DECOY | Honeypot deployment — fake API keys, mock endpoints, trap registries. Capture attacker activity. |
| 04 | JUDGE | Variant fingerprinting — identify exact dark AI variant and classify attacker objective. |
| 05 | EXECUTOR | Active countermeasures — error injection, malware corruption, output poisoning, session redirect, C2 disruption. UNLEASHED only. |
| 06 | DARKFEED | Threat intelligence — real-time tracking of new dark AI variants on underground markets. |
| 07 | RAIN | Forensic evidence — attacker prompts, generated malware, infrastructure. Ed25519 signed. RESTRICTED. |
ANTIDOTE NOT APPLICABLE. JUSTICE targets attacker infrastructure, not your own. There is nothing to restore. The disruption IS the outcome.