Run direct, indirect, multi-turn, encoded, split-payload, and…

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM01

   R05 — MITRE ATLAS

   R28 — Microsoft PyRIT scoring

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Execute cross-project direct, indirect, multi-turn Crescendo (D1), Base64/encoded, split-payload, multimodal OCR/audio, and tool-output prompt-injection campaigns across P1, P2, and P3.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Score every attack strictly by unauthorized impact (unauthorized tool call, data leak, citation spoof, approval bypass), never by whether the model's refusal sounded polite.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Cross-project injection red-team report and updated D8 regression test cases.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R28Microsoft PyRIT↗ github.com

  Python Risk Identification Tool: targets, orchestrators, converters, scorers, and multi-turn attack automation.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP GenAI Security Project
  OWASP Top 10 for LLM Applications

  The 2025 risk list that names prompt injection, improper output handling and excessive agency, giving each campaign you run a standard risk ID to report against.

  R04checked 2026-11-11
• videoMicrosoft Developer
  Episode 8: Automating AI Red Teaming with PyRIT | AI Red Teaming 101

  The PyRIT author walks through orchestrators, converters and scorers, showing how to script multi-turn attacks instead of hand-running single prompts.

  R28checked 2026-11-11
• videoPriyabrat Swain
  Indirect Prompt Injection Explained | AI Security

  Contrasts indirect with direct injection and walks real attack scenarios, which is the split-payload and tool-output campaign class you are executing across P1 to P3.

  R04checked 2026-11-11
• articleMicrosoft Learn
  2. Prompt Injection (Direct / Indirect)

  Frames untrusted content as adversarial by default and lists the controls that follow, useful for scoring which campaign variants your target actually resists.

  R04R05checked 2026-11-11
• repoGitHub
  microsoft/PyRIT

  The toolkit itself: targets, orchestrators such as Crescendo, converters for Base64 and other encodings, and scorers, which is the whole D1/D8 campaign harness.

  R28checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.