Hands-On-Ai-Security - A Hands book on ai security from foundation to pro

项目说明

Hands-On AI Security

A builder's book, not a hunter's book. You build an attacker, a defender,
and a target — three small systems that grow up together across the book —
and you learn AI security by breaking and fixing your own machines, not by
reading about someone else's.


--

What this is

Most security writing is a *hunter's* book: here's a bug class, here's where
it hides, go find it in the wild. This isn't that. There's no scope question
and no authorization question here — the target is always yours. You build
the system, you build the thing that attacks it, and you build the thing that
defends it, and you watch all three collide on a machine that's entirely
yours.

Proof o runs through every part of it. A claim that a
system is safe is worth nothing until something you built and ran
demonstrates it — not a 's datasheet, not a model card, not "the
prompt tells it not to." Every number in this book traces back to something
actually built and actually run — including a "hardening" system prompt
that, tested for real, stopped zero of six attacks.

Not written for one role. Useful to a bug-bounty hunter extending into AI
targets, someone learning AI who needs the security lens, a red/blue teamer
who wants real backend and model internals instead of talk.

Status

| Part | Covers | Status |
|---|---|---|
| One — Foundation | , the deterministic- reframe, the OWASP web + LLM maps, the 7-class threat taxonomy, real dated incidents, the HTTP/API/SQL machinery underneath it all | written |
| Two — Prompt Injection | Direct *and* indirect injection, still text-only. Build a target, an attacker, a shield and a ; hit the judge problem; watch a model upgrade regress your posture | written |
| Three — Agentic Attacks | The target grows real tools. Tool abuse, MCP, multi-agent handoffs, a real guardrail survey, and a harness that from the tool-call trace rather than the text | planned |
| Four — AI-Dri | An original benchmark of agent targets, taught from both sides: how to break it, how to fix it | planned |

Each part is complete on its own - you finish it having gained something,
not holding an IOU for a later part.

Read it

Part One is written and builds to PDF. The book text itself is not in this
repository - this repo carries the code, the attack corpus and the figures
so you can run e the book builds.

Who this is for

Part One assumes nothing — a motivated beginner can start there. **From
Part Two onward**, the book assumes comfort with Python and basic ML, and
gets genuinely technical. Full frontier-model fine-tuning is acknowledged as
a compute reality most readers won't have; the achievable, teachable
technique — BERT-scale fine-tuning on a free notebook — is the one you'll
actually do.

Running the code

E runs locally. No API keys, no cloud, no bill.

You need Ollama with a model pulled. The book uses an
*abliterated* (safety-stripped) model as the target on purpose — so that when
an attack fails later, it failed because your shield stopped it, not
because the model's own training caught it first:

Then, from code/part-02/:

Any model works — edit MODEL in llm.py. The attack corpus lives in
attack_db/, and corpus.py finds it relative to the repo, so a fresh
clone runs as-is.

Before you begin

**You only test systems you own, or ha, written authorization to
test.** Every attacker, target, and defender in this book runs on your own
machine, on purpose — so that rule is easy to keep, but the responsibility
to keep it is yours.

License

This project is split deliberately.

Open — Part One (Foundation) and Part Two (Prompt Injection):

Code and the attack corpus — Apache-2.0

Book text and figures — CC BY-SA 4.0

Use it, adapt it, translate it, build on it — commercially or not. Two
conditions: credit Sanskar Jajoo, and if you distribute something built
on the book material, keep it under the same license.

**Reserved — Part Three (Agentic Attacks) and Part Four (AI-Driven
Cybersecurity):** © Sanskar Jajoo, all rights reserved. These are the deeper
agentic-AI and security materials, and no license is granted for them.

Full detail, including what a license can and cannot require, is in
LICENSING.md.

Citation

This repo includes a CITATION.cff, so GitHub's "Cite this repository"
button produces a correct APA or BibTeX entry.

Contact

Issues and discussion welcome on this repo. For anything else: reach out via
github.com/m4vic.

项目信息

开发语言：D2

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Hands book on ai security from foundation to prompt injection, indirect prompt injection , offensive , defensive, agentic security . 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。