tensor-trust - A prompt injection game to collect data for robust

项目说明

Tensor Trust

A prompt injection attack game to collect data for ad ML research

This is the source code for the Tensor Trust web game and data cleaning pipeline. See the paper website for more details on the project. You can also use the data, or go play the game!

If you build on our code or data in an academic publication, please cite us with the following BibTeX:

Installation

To install and run, first set up OpenAI API key if you have not already:

1. Login to OpenAI account and go to .
2. Create an API key.
3. Now open a shell: on Windows run set OPENAI_API_KEY=<your-key>, and on Unix run export OPENAI_API_KEY=<your-key>.

Now run the following:

Now you can visit a de copy of the website at

Database Management

Django handles database management with Models, which we define in src/promptgame/gameui/models.py. Whenever
you edit a Model, you need the change to be reflected in the underlying database that
Django is managing. To do this, run:

In git terms, makemigrations is like creating a commit recording your change to the database. This migration
is actually tracked within a file in the src/promptgame/migrations directory. Running migrate is like
pushing this commit, and thus actually updates the database. To find out more about this process (including
how to do more complex behavior such as revert your database back to a previous migration state), click
here.

Note that if you are pulling from main after someone has made a change to a model, you will also have to run ./manage.py migrate to apply the new migrations generated by the other person.

Creating an admin account

To create an admin account, run:

Follow the prompts to create a username and password.

the admin interface

Log in to the admin page at localhost:8000/private/dj-login/.
On the prod site, this will be at tensortrust.ai/private/dj-login/.

Enter the username and password you created above. If you are on the prod site, you'll have to get the password by opening a terminal and running gcloud secrets access --secret=promptgame_prod_application_settings latest.

What's up with Tailwind?

Tailwind is a CSS framework that makes it easier to
embed CSS directly in your HTML tags, as opposed to putting your HTML source and
your CSS source on different places. It works by stuffing style information
into a set of predefined classes, like this mix of HTML and Tailwind classes
that defines a rounded purple button:

You might notice from this example that the set of possible Tailwind classes is
really large. e.g. text-[0.8125rem] makes the text 0.8125 rem high, but what
if the user asked for 0.31 rem or $\pi$ rem? It turns out that Tailwind allows
for an unlimited number of possibilities, so the set of valid Tailwind classes
is technically infinite.

Of course, browsers can only handle a finite number of defined, styled classes,
so Tailwind needs some way of figuring out which classes it actually has to
generate and which it can skip. It does this using a CSS compiler. For
de purposes, the compiler can be run dynamically in your web browser by
inserting this tag into the head of your document:

This works but has the drawback of being slow and sometimes causing unstyled
content to
display. I'm also
slightly worried that we'd be banned from their CDN if we used it in production,
but I don't know how likely that actually is.

For both of these reasons, we instead use Tailwind's ser compiler (via
django-tailwind).
The ser compiler is written in Ja, which is why we need Node,
and also why we need to run ./manage.py tailwind install to download all of
Tailwind's dependencies when first installing on a new machine. The compiler
scans your source code (HTML, Python, Ja) for things that look like
Tailwind class names, then generates all of them and puts them into this
stylesheet:

The stylesheet is checked into control, so when you run ./manage.py
tailwind start, the changes made by the li will also show up in git
diffs. This is a bit ugly but ultimately fine, because the produced
styles.css file is only a few thousand lines long.

Django Silk

Deployment on GCP

This project is configured to be deployed on GCP. It turned out to be
surprisingly complicated, since we needed:

The details of how it is all set up are in an internal doc (please see internal TT channel if you're a CHAI affiliate who needs access).

To deploy a new of the website, you only need to know a tiny subset of
what's in that doc. Once you ha permissions on the
prompt-ad-game GCP project, you can cut a new staging deployment like this:

1. You commit your changes to the git repo (and ideally push).
2. Set up the project of gcloud:

3. From the root of your repo, run a Cloud Build command to create a new Docker image:

This will build an image on Google's servers using the current git repo and
the Dockerfile in the root of the repo. The image will be named
gcr.io/prompt-ad-game/promptgame-staging with a :latest tag, as well as a
tag consisting of the last 7 digits of the current git re.
4. Apply migrations to the staging instance, and collect static files (this
implicitly uses the :latest image that you built above):

5. Deploy to the staging site with this command:

If all commands succeed, the app should be running on our staging site! You can use this as an
opportunity to play with it in a low-stakes setting—it's fine if our staging
site gets messed up, so long as we fix the bugs before going to production.

Once you' that the app works in staging, you can push it to
production:

1. Add a new tag to the staging image you generated above to indicate that
you're ready to use it in production as well. In this case I used re
0f043fc, but you can figure out the right tag for you image using this
command:

Once you have the right tag for the staging image, you can use this command to also tag that image as the latest production image:

2. Now collect static and run migrations:

3. Finally, deploy to Cloud Run:

Once you' all these steps, the code you ran successfully on the
staging site should be a on the staging site as well!

There are lots of other details I haven't covered here, like how to add new
settings that differ between staging and prod, or how to re-create the staging
en from scratch. The (very long) Google doc linked abo answer
some of those questions, but you can also ping Sam on Slack if you want
pointers.

项目信息

开发语言：Python

Star 数：78

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A prompt injection game to collect data for robust ML research展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。