Multimodal Conflict Hardening

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — LLM Top 10

   R05 — MITRE ATLAS

   R45 — NIST Adversarial ML

   R25 — Docker security

   R26 — vLLM serving

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add one more realistic cross-modal conflict case (OCR text vs. audio transcript vs. PDF metadata) to P2 (D5) and verify modality provenance survives chunking, reranking, and citation rendering.

   Re-verify all Docker Compose services across P1–P3: confirm zero unintended host port bindings, non-root execution, read-only root filesystems, bounded queues, and D2/D12 container integrity.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 105 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   New multimodal provenance regression test + clean infrastructure security audit log.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

• R26vLLM Documentation↗ docs.vllm.ai

  Serving architecture, OpenAI-compatible server, authentication, concurrency flags, and production deployment.

• R45NIST AI 100-2 (Adversarial ML)↗ doi.org

  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (evasion, poisoning, privacy, abuse).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsvLLM Project · Serving + deployment docs
  vLLM Documentation

  Covers the OpenAI-compatible server surface, `--api-key` authentication, batching and concurrency controls, and the production stack — the reference for bounded queues and exposed endpoints across P1–P3.

  R26moved 2026-11-11
• videoAnyscale · 34 min
  Fast LLM Serving with vLLM and PagedAttention

  Explains PagedAttention and continuous batching from the team that built vLLM, which is the mechanism behind KV-cache memory pressure and the concurrency flags you tune when hardening the serving tier.

  R26checked 2026-11-11
• videoTales Of Tensors · 10 min
  PagedAttention: Behind vLLM's Insane Speed

  A block-table walkthrough of how logical KV blocks map to non-contiguous physical memory, including prefix caching and preemption, so you can reason about memory-bound failure modes under load.

  R26checked 2026-11-11
• articleNVIDIA Technical Blog · 12 min read
  Securing Agentic AI: How Semantic Prompt Injections Bypass AI Guardrails

  Shows why OCR-based filtering fails once models ingest images and audio natively rather than through an image-to-text hop, which is the exact cross-modal conflict case you are adding to D5.

  R04R45checked 2026-11-11
• docsDocker · Reference doc
  Docker Engine security

  The daemon attack surface, namespace and capability model, and non-root/read-only guidance you re-verify service by service in Compose, including why mounting the socket is equivalent to host root.

  R25checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.