AI Security Lab
Security for AI: the tool I built to attack my own assistants, tracked by what is built, what is proven, what is not yet, and what the tests actually found.
Security for AI — IEM-AIS
Ramani-Viswanathan/IEM-AISA URL-driven tool that sends real prompts to real, live LLM endpoints and records the real replies — no mocked targets, no simulated responses. Every test case is grounded in the OWASP GenAI LLM Top 10 2026, fetched at runtime rather than bundled as a stale copy.
What was actually tested
- The tool discovered both target endpoints itself from the site’s served code — /api/chat and /api/liftoff-chat — rather than being told where to aim.
- A negative control against a site with no LLM interface correctly returned is_llm_site: false and sent zero prompts. The analyzer does not false-positive.
- Eight test cases now built, one per practically-testable OWASP GenAI LLM Top 10 category (LLM01, LLM02, LLM03, LLM06, LLM07, LLM08, LLM09, LLM10), each with its own classifier — some refusal-marker matching, some inverted (a compliant reply is the bad outcome), some length/latency thresholds with a burst mode for Denial of Wallet.
- It found things, on this site. A full run against ramaniv.com itself flagged an OUTPUT_UNSAFE result — the chat widget’s markdown renderer would auto-fetch a model-emitted image URL, a real exfiltration path (OWASP LLM10:2026). Fixed the same day (image rendering disabled at every render site, message-length and output-token caps added), then re-run: the finding no longer stands.
- 61 fixture-based tests (pytest, zero network calls) cover every classifier’s verdict shapes across all eight test cases.
- Every verdict carries its heuristic caveat inline. The tool never issues a bare “SECURE”.
Scope of testing
Tested against LLM endpoints I operate myself — deliberately different in shape, which is how the tool ended up with several distinct classifier designs rather than one reused matcher. Self-operated targets validate the tool; they do not validate it against defenses I did not write. Public safe-harbor targets are next.
Raw prompt and reply evidence is recorded locally and not published.
Not built
LLM04 Supply Chain and LLM05 Data and Model Poisoning are out of scope by design — reasons stated in the repository rather than silently omitted.
No public responsible-disclosure policy is published for this tool yet.
Updated 15 Oct 2026