RedAiRange - A professional AI security range for red teaming,

项目说明

Red AI Range (RAR)


Red AI Range is a professional platform for AI security assessment, AI red team operations, and research. It provides controlled and repeatable en where teams can test AI systems, defenses, and train personnel with practical scenarios.

As AI adoption grows across critical systems, organizations need a structured way to e security risk. Red AI Range addresses that need with a unified platform that combines targets, security tooling, operational controls, and documentation support.

![]()

Table of Contents

Installation and Quick Start

Features and Capabilities

Applications and Use Cases

UI O and Getting Started

Contributing

Red AI Range (RAR) Training Modules

Installation and Quick Start

Docker Setup

1. Clone the repository.

2. Start the platform.

By default, the platform is a at

Docker Compose Example for macOS

If you are on macOS, always use a full absolute path for stack .

Docker Compose Example for Linux and Windows

Optional Nati Mode

Optional Security En

| | Default | Description |
| --- | --- | --- |
| REDAIRANGE_JWT_EXPIRES_IN | 7d | Sets JWT lifetime, for example 12h, 7d, 30d |
| REDAIRANGE_CONSOLE_ALLOWLIST | docker,ls,cd,dir,cat,echo,pwd | Defines allowed commands for the built in console |
| REDAIRANGE_AGENT_CREDENTIALS_KEY | auto generated | Optional key for credential encryption at rest |
| REDAIRANGE_WS_ORIGIN_CHECK | strict | strict enforces host check, bypass disables it |

Example:

Architecture Note

The platform runs as a Docker container and manages scenario containers through the mounted Docker socket. This model provides strong isolation, clean reset workflows, and consistent behavior across en.

Key Capabilities

AI Security Operations

* Structured assessment workflows
* Repeatable attack and defense exercises
* Standardized reporting and knowledge capture
* Team training support for AI security programs

Container Based Scenario Management

* Isolated dependencies for each scenario
* Reproducible en for testing and
* Fast reset and cleanup of test infrastructure
* Parallel operation of multiple scenarios

Deployment Controls

* Arsenal mode for security tools
* Target mode for AI systems
* Compose mode for custom stack workflows

Remote Agent Support

* Secure connections to remote Red AI Range nodes
* Central management for distributed teams
* Support for specialized infrastructure such as GPU systems

Session Recording

* Video recording for demonstrations and training
* Timestamp based activity tracking
* Download support for audit and knowledge transfer

Docker in Docker Design

* Clear separation between host and scenario runtime
* Predictable resource usage and cleanup
* Consistent behavior on different host platforms

Operational Use Cases

Security Research Teams

* Explore new AI attack
* proof of concept exploits
* Publish reproducible findings

Enterprise Security Teams

* Test AI systems before production release
* Run recurring security
* Train analysts with practical scenarios

Academic and Training Programs

* Deli AI security education
* Run labs and workshops in a controlled en
* Build standard training paths for AI risk topics

Interface O

The interface is designed to simplify scenario deployment and daily operations.

Main Na

* Range Manual for internal documentation
* Compose for custom en deployment
* Arsenal for security tool deployment
* Target Machines for scenario deployment


Arsenal: Launch security assessment tools and exploitation frameworks.


Target Machines: Set up intentionally AI targets for testing.


#### Activity Status
The dashboard prominently displays the status of the deployed en:

Active: Number of en currently running.

Exited: Number of en recently terminated.

Inactive: Number of a but not currently deployed en.

#### En Management
Each AI security scenario can be rapidly managed through the following controls:

Docker Run: Quickly execute Docker commands for selected en.

Convert to Compose: Transform running en into reusable docker-compose files.

Convert to Target/Arsenal: Categorize and deploy en either as a target machine (for testing) or as an arsenal tool (for security assessments).


#### AI Security Scenarios List
The left-hand pane displays predefined AI security scenarios, including but not limited to:

Ad Playground

Blackcart Arsenal

Defense AI Target

E Attacks

Gen AI Target

Model Tampering

Privacy Attacks

#### Agent Control Panel
Manage and monitor connected remote agents:

Easily add new agents.

View current agent connectivity status.

#### Additional Components

Settings: Allows changing , configurations and credentials.


Console: A basic terminal for performing simple actions on the Docker container.

Record: When enabled, starts a video recording to document actions taken by the user for knowledge build-up purposes.

Getting Started by Running a Machine with a Scenario

As mentioned before, left pane contains predefined AI security scenarios and the related containers with AI components. Although you can run a target machine from Target Machine page with your configurations, starting with a scenario is recommended.

For example, when you click on "adtarget" from the left pane, this page will greet you.

When it is started, required images will be pulled and Docker container will be started. You can monitor the process from terminals on this page. In addition, you can access a shell from the container from this page.

After the machine is started, you will be able to access the ports that are mentioned above of the terminal. This port is for accessing the Jupyter notebook with materials related to the scenario. In this example, will redirect you a login page when you access it for the first time:


In this page, you can create a password or directly use the token to access Jupyter Notebook. The token can be found on the terminal of the machine. With this token, you can pass the authentication and access this page:


From here, you can follow the scenarios, improve your AI/ML skills, learn different attack methodologies and more.

Contributing

Contributions are welcome! Please see CONTRIBUTING.MD for details on how to get in, file bug reports, and submit pull requests.

Enjoy exploring and securing AI systems with RedAIRange! If you have any questions or run into issues, feel free to open an issue or start a discussion in this repository.

Training Modules

The training path is organized into fi.

Module 1: Foundations of AI Security

AI/ML Fundamentals

- Understanding AI and Machine Learning
- Types of ML and the ML lifecycle
- Key algorithms in ML
- Neural networks and deep learning
- ML de tools

Building Secure De En

- Setting up de en
- Python and dependency management
- en for AI security
- Working with Jupyter notebooks
- Hands-on baseline ML implementations
- Simple neural network implementations
- ML de at scale (Google Colab, AWS SageMaker, Azure ML)

Security Essentials for AI Systems

- Security fundamentals for AI
- Threat modeling for AI systems
- Risk assessment and mitigation strategies
- De for AI de
- Host security in AI en
- Network protection for AI systems
- Authentication mechanisms
- Data protection techniques
- Access control implementation
- Securing code and artifacts

Module 2: Model De Attacks

Poisoning Attack Techniques

- Basics of poisoning attacks
- Poisoning attack taxonomies
- Staging simple poisoning attacks
- Creating poisoned samples
- Backdoor poisoning attacks
- Hidden-trigger backdoor attacks
- Clean-label attacks
- Ad poisoning techniques
- Mitigations and defenses
- Anomaly detection for poisoning protection
- Robustness testing against poisoning
- Ad poisoning defenses with ART
- Ad training strategies

Model Tampering Techniques

- Backdoor injection using serialization
- Trojan horse injection with Keras Lambda layers
- Custom layer-based Trojan horses
- Neural payload injection techniques
- Edge AI attacks
- Model hijacking strategies
- Trojan horse code injection
- Model reprogramming techniques
- Defense strategies against tampering

Supply Chain Attacks

- Traditional supply chain risks in AI
- components in AI systems
- Securing AI from dependencies
- Private repository configuration
- Software Bill of Materials (SBOM) implementation
- Transfer learning security risks
- Model poisoning in pre-trained models
- Model tampering in supply chains
- Secure model pro and go
- MLOps and private model repositories
- Data poisoning in supply chains
- Sentiment analysis manipulation techniques

Module 3: Attacks on Deployed AI

E Attack Techniques

- Fundamentals of e attacks
- Reconnaissance for e attacks
- Perturbation techniques for images
- One-step perturbation with FGSM
- Basic Iterati (BIM)
- Jacobian-based Saliency Map Attack (JSMA)
- Carlini and Wagner (C&W) attack
- Projected Gradient Descent (PGD)
- Ad patches - physical and digital
- NLP e with TextAttack
- Uni Ad Perturbations (UAPs)
- Black-box attacks and transferability
- Defenses against e attacks
- Ad training implementation
- Input preprocessing strategies
- Model hardening techniques
- Model ensemble approaches
- Certified defense implementation

Privacy Attacks - Model Theft

- Understanding privacy attacks
- Model extraction methodologies
- Functionally equi extraction
- Learning-based model extraction
- Generati extraction (distillation)
- Practical extraction against CIFAR-10 CNN
- Defense and mitigation strategies
- Detection measures for model theft
- Model ownership identification and recovery

Privacy Attacks - Data Theft

- Model in attack techniques
- Exploiting model confidence scores
- GAN-assisted model in
- Practical model in demonstrations
- Inference attack methodologies
- Attribute inference attacks
- Meta-classifier implementation
- Poisoning-assisted inference
- Membership inference attacks
- Statistical thresholds for ML leaks
- Label-only data transferring
- Blind membership inference
- White-box attack techniques
- Practical defenses and mitigations

Pri AI

- Pri ML fundamentals
- Data anonymization techniques
- Ad anonymization strategies
- K-anonymity implementation
- Geolocation data anonymization
- Rich media anonymization
- Differential privacy (DP) implementation
- Federated learning (FL) approaches
- Split learning for privacy
- Ad encryption for ML
- Secure multi-party computation
- Homomorphic encryption techniques
- Practical pri ML implementation

Module 4: Generative AI Security

Generative AI Fundamentals

- Introduction to generative AI
- E of generative AI technologies
- GANs implementation techniques
- De GANs from scratch
- WGANs and custom loss functions
- Working with pre-trained GANs
- Pix2Pix and CycleGAN implementation
- BigGAN and StyleGAN implementation

GAN Security - Deepfakes and Attacks

- Deepfake creation and detection
- StyleGAN for synthetic images
- GAN-based image manipulation
- Video and animation synthesis
- Voice deepfake technologies
- Deepfake detection techniques
- GAN-based face e
- Biometric authentication attacks
- Password cracking with GANs
- Malware detection e
- GANs in cryptography and steganography
- Web attack payload generation
- Ad attack payload generation
- GAN security implementation
- Defenses against deepfakes and misuse

LLM Security Fundamentals

- Introduction to LLMs
- De applications with LLMs
- Python implementation with LLMs
- LangChain implementation
- Data integration with LLMs
- LLM impact on ad AI

Prompt Injection Attacks

- Ad inputs and prompt injection
- Direct prompt injection techniques
- Prompt o strategies
- Style injection methods
- Role-playing attacks
- Impersonation techniques
- Ad jailbreaking methods
- Gradient-based prompt injection
- Data integration risks
- Indirect prompt injection
- Data exfiltration injection
- Pri escalation with LLMs
- Remote code execution
- Platform-le measures
- Application-le strategies

LLM Poisoning Techniques

- Poisoning embeddings in RAG systems
- Embedding generation poisoning
- Direct embeddings poisoning
- Ad embeddings poisoning
- Query embeddings manipulation
- Defense strategies for RAG
- Fine-tuning poisoning techniques
- Fine-tuning attack
- Practical attacks against commercial LLMs
- Defenses for fine-tuning security

Ad Generative AI Attacks

- Supply-chain attacks in LLMs
- Model repository poisoning techniques
- Model tampering on distribution platforms
- Privacy attacks against LLMs
- Training data extraction from LLMs
- Inference attacks against LLMs
- Model cloning techniques
- Defense strategies for ad attacks

Module 5: Defensi and Operations

Secure-by-Design AI

- Secure-by-design AI principles
- Building AI threat libraries
- Traditional cybersecurity integration
- AI-specific attack taxonomy
- Generative AI attack
- Supply chain attack pre
- Industry AI threat taxonomy mapping
- NIST AI taxonomy implementation
- MITRE ATLAS framework integration
- Threat modeling methodologies for AI
- Practical AI threat modeling
- Risk assessment and prioritization
- Security design implementation
- Testing and strategies
- Shifting left in AI de
- Operational security monitoring
- Trustworthy AI implementation

MLSecOps Implementation

- The MLSecOps imperative
- MLSecOps 2.0 framework implementation
- Orchestration options for security
- MLSecOps patterns and best practices
- Building MLSecOps platforms
- Model sourcing and workflows
- LLMOps security integration
- Ad MLSecOps with SBOMs
- Continuous security testing

Enterprise AI Security

- Enterprise security challenges
- Foundations of enterprise AI security
- Security framework implementation
- Operational AI security strategies
- Iterati security approaches
- Maturity assessment
- Go implementation
- Regulatory compliance

项目信息

开发语言：Jupyter Notebook

Star 数：131

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A professional AI security range for red teaming, vulnerability research, defensive validation, and hands-on AI/ML security training.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。