----------------
🎯 AI
===================
Arcanum AI Security Resource Hub is a curated directory of challenge platforms for practicing AI security. The collection spans beginner to advanced levels and covers the core attack surfaces in modern LLM deployments.
Core Features
The directory organizes platforms by difficulty and deployment model. Hosted options like Lakera Gandalf, Wiz AI CTF, and Forces Unseen's prompt injection games require zero setup. Self-hosted labs, including the OWASP LLM Top 10 CTF and the "Juice Shop for Agentic AI," run locally with Python and Ollama using open models such as Mistral and Llama3.
Technical Coverage
• Prompt injection: Direct and indirect techniques, including cross-user data leakage and authentication bypass through LLM manipulation
• Jailbreaking: Progressive challenges from basic password extraction to advanced guardrail circumvention
• Agentic AI attacks: Goal manipulation against tool-using AI agents, multi-step agentic workflow exploitation, and attacks on chained LLM systems performing data transformation in banking contexts
• RAG and document processing: Vulnerabilities in retrieval-augmented generation systems and document-focused AI security
• OWASP LLM Top 10: CTF-style challenges mapped to recognized risk categories
• Adversarial ML: Model inversion, data poisoning, and adversarial attacks via Garak's 80+ challenge set
Notable Platforms
• Lakera Gandalf: Classic progressive prompt injection challenge
• PortSwigger Labs: Four labs covering indirect injection, data exfiltration, cross-user leakage, and auth bypass
• OWASP LLM Goat: Deliberately vulnerable chatbot lab for the OWASP LLM Top 10
• Garak: Professional platform with 80+ challenges including DEFCON and Black Hat content
• Wiz AI CTF: Five challenges manipulating a customer-service chatbot
Strengths
The directory provides breadth across difficulty levels and attack categories. The mix of hosted and self-hosted options accommodates different environments, including air-gapped setups.
Limitations
Some platforms are marked buggy or offline. The "Juice Shop for Agentic AI" public Render demo is currently down. The directory provides minimal context beyond difficulty level and brief descriptions, so practitioners need to evaluate relevance independently.
🔹 bookmark #prompt_injection #LLM_security #AI_CTF #OWASP_LLM
🔗 Source: https://arcanum-sec.github.io/ai-sec-resources/