Shuciran Pentesting Notes

Working with AI Agents

Introduction The AI Agent that were are going to build is going to do the following things: 1) When asked to summarize the content of a website, the AI agent will summarize the content of the webs...

Abusing AI Agents

Introduction Setting up the AI Agent echo -e "\033[0;32m----------Updating apt package installer, and installing python package manager __pip__----------\033[0m" apt update && apt install ...

Threat Modeling an AI System

Introduction Scope of threat modeling can be the amount of application features or design that needs to be threat modeled, and the time that is available for the threat modeling activity. Traditio...

Signing and Verifying Machine Language Models using Cosign

Understanding Model Signing and Verification Cosign is a powerful tool that simplifies the signing and verification process for various digital artifacts, including container images. Its capabiliti...

Scanning Models and Injecting Malicious Code

Introduction The lab is not about creating a super helpful model or a chatbot, but understanding how to embed executable code inside a model. Requirements mkdir malicious-models cd malicious-model...

Editing Models Using Rank-One Model Editing (ROME) Technique

Introduction Model editing refers to the process of modifying a pretrained machine learning model’s internal knowledge or behavior without retraining it from scratch. The goal of model editing is ...

Creating Trojanized Neural Network Models

Introduction The lab is not about creating a super helpful model or a chatbot, but understanding how to embed executable code inside a model. Requirements mkdir trojan-neural-network-model cd troj...

Creating Trojanized Models

Introduction The lab is not about creating a super helpful model or a chatbot, but understanding how to embed executable code inside a model. Requirements mkdir trojan-model cd trojan-model apt up...

Guarding LLM Input and Output

Introduction Requirements apt update && apt install -y python3-virtualenv mkdir llm-chatbot-with-guard cd llm-chatbot-with-guard virtualenv venv source venv/bin/activate cat > requirem...

Scanning an LLM for Agent Based Vulnerabilities

Introduction What is Garak? Garak (Generative AI Red-teaming & Assessment Kit) is a comprehensive toolkit designed for security testing of language models. Think of it as the “nmap” for LLMs -...