Study advanced injection patterns

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM Top 10

   R05 — MITRE ATLAS multi-turn patterns

   R28 — Microsoft PyRIT orchestrator concepts

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study multi-turn escalation (Crescendo), payload splitting, and Base64/ROT13 obfuscation. Build the stateful multi-turn attack harness (D1) that tracks conversation state, attack stage, model version, and tool-call outcomes.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run staged multi-turn escalation sequences against P1 and record whether multi-turn grooming bypasses single-turn checks.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Attack taxonomy and reproducible multi-turn transcript logs in D1.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R28Microsoft PyRIT↗ github.com

  Python Risk Identification Tool: targets, orchestrators, converters, scorers, and multi-turn attack automation.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsGitHub
  Azure/PyRIT: The Python Risk Identification Tool for generative AI

  Documents the target, orchestrator, converter, and scorer abstractions plus multi-turn orchestrators, which is the structure your stateful Crescendo harness needs to record attack stage and tool-call outcomes.

  R28S2checked 2026-11-11
• videoMicrosoft Developer · 8:12
  Episode 8: Automating AI Red Teaming with PyRIT | AI Red Teaming 101

  Shows converting a manual attack into an automated PyRIT run with scorers, the step between a one-off payload and a repeatable multi-turn harness.

  R28checked 2026-11-11
• videoProbably Private · 13:36
  Red Teaming Mini Course: Attacking LLMs with other LLMs (Crescendo Attack)

  Walks the Crescendo escalation where each benign-looking turn raises the baseline of the last, which is the state machine your fuzzer must track across turns.

  S2checked 2026-11-11
• articleCrescendo (research project page)
  Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack

  Defines the attack formally with the escalation and backtracking policy, giving you the turn-level stages and success criteria to encode in the harness.

  S2R05checked 2026-11-11
• labGitHub
  NVIDIA/garak: the LLM vulnerability scanner

  Ships probe and detector modules including encoding and obfuscation-based attacks, so you can diff your Base64/ROT13 payload splitting results against a known scanner on the same local model.

  S2R04checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.