From e7c265ed28176accbb4b754305b8530d2e7c7917 Mon Sep 17 00:00:00 2001 From: shiva108 Date: Sat, 10 Jan 2026 14:28:32 +0100 Subject: [PATCH] update chapter links --- ...apter_01_Introduction_to_AI_Red_Teaming.md | 6 +- ...ics_Legal_and_Stakeholder_Communication.md | 6 +- docs/Chapter_03_The_Red_Teamers_Mindset.md | 6 +- ...les_of_Engagement_and_Client_Onboarding.md | 6 +- ...er_05_Threat_Modeling_and_Risk_Analysis.md | 6 +- docs/Chapter_06_Scoping_an_Engagement.md | 4 +- ...r_07_Lab_Setup_and_Environmental_Safety.md | 4 +- ...ence_Documentation_and_Chain_of_Custody.md | 4 +- ...LLM_Architectures_and_System_Components.md | 6 +- ..._10_Tokenization_Context_and_Generation.md | 4 +- ...11_Plugins_Extensions_and_External_APIs.md | 4 +- ...eval_Augmented_Generation_RAG_Pipelines.md | 4 +- ...ta_Provenance_and_Supply_Chain_Security.md | 6 +- docs/Chapter_14_Prompt_Injection.md | 6 +- .../Chapter_15_Data_Leakage_and_Extraction.md | 6 +- ...ter_16_Jailbreaks_and_Bypass_Techniques.md | 6 +- .../Chapter_17_06_Case_Studies_and_Defense.md | 6 +- ...sion_Obfuscation_and_Adversarial_Inputs.md | 6 +- docs/Chapter_19_Training_Data_Poisoning.md | 4 +- ...20_Model_Theft_and_Membership_Inference.md | 4 +- ...hapter_21_Model_DoS_Resource_Exhaustion.md | 4 +- ...apter_22_Cross_Modal_Multimodal_Attacks.md | 4 +- ...hapter_23_Advanced_Persistence_Chaining.md | 4 +- docs/Chapter_26_Supply_Chain_Attacks_on_AI.md | 6 +- docs/Chapter_28_AI_Privacy_Attacks.md | 4 +- docs/Chapter_29_Model_Inversion_Attacks.md | 4 +- docs/Chapter_30_Backdoor_Attacks.md | 4 +- docs/Chapter_31_AI_System_Reconnaissance.md | 4 +- .../Chapter_32_Automated_Attack_Frameworks.md | 4 +- docs/Chapter_33_Red_Team_Automation.md | 4 +- docs/Chapter_34_Defense_Evasion_Techniques.md | 4 +- ...pter_35_Post-Exploitation_in_AI_Systems.md | 4 +- docs/Chapter_40_Compliance_and_Standards.md | 4 +- docs/Chapter_41_Industry_Best_Practices.md | 2 +- ...Chapter_42_Case_Studies_and_War_Stories.md | 2 +- docs/Chapter_43_Future_of_AI_Red_Teaming.md | 2 +- docs/Chapter_44_Emerging_Threats.md | 2 +- ...pter_45_Building_an_AI_Red_Team_Program.md | 2 +- scripts/link_next_steps.py | 107 ++++++++++++++++++ 39 files changed, 191 insertions(+), 84 deletions(-) create mode 100644 scripts/link_next_steps.py diff --git a/docs/Chapter_01_Introduction_to_AI_Red_Teaming.md b/docs/Chapter_01_Introduction_to_AI_Red_Teaming.md index 16787d1..56326be 100644 --- a/docs/Chapter_01_Introduction_to_AI_Red_Teaming.md +++ b/docs/Chapter_01_Introduction_to_AI_Red_Teaming.md @@ -158,9 +158,9 @@ The handbook is organized for practical learning and use: ### Next Steps -- **Chapter 2:** Ethics, Legal, and Stakeholder Communication—deep dive into professional responsibilities -- **Chapter 3:** The Red Teamer's Mindset—develop the critical thinking skills needed for success -- **Chapter 7:** Lab Setup and Environmental Safety—create safe practice environments +- [Chapter 2: Ethics Legal and Stakeholder Communication](Chapter_02_Ethics_Legal_and_Stakeholder_Communication.md) +- [Chapter 3: The Red Teamers Mindset](Chapter_03_The_Red_Teamers_Mindset.md) +- [Chapter 7: Lab Setup and Environmental Safety](Chapter_07_Lab_Setup_and_Environmental_Safety.md) > [!TIP] > Before proceeding further, ensure you understand the legal and ethical boundaries of AI red teaming. Chapter 2 provides detailed guidance on navigating these critical considerations. diff --git a/docs/Chapter_02_Ethics_Legal_and_Stakeholder_Communication.md b/docs/Chapter_02_Ethics_Legal_and_Stakeholder_Communication.md index 4ad3193..07ea0cb 100644 --- a/docs/Chapter_02_Ethics_Legal_and_Stakeholder_Communication.md +++ b/docs/Chapter_02_Ethics_Legal_and_Stakeholder_Communication.md @@ -153,9 +153,9 @@ In AI red teaming, technical findings may have legal, business, or even social i ### Next Steps -- **Chapter 3:** The Red Teamer's Mindset—develop critical thinking and adversarial perspectives -- **Chapter 4:** SOW, Rules of Engagement, and Client Onboarding—practical templates for authorization -- **Chapter 8:** Evidence, Documentation, and Chain of Custody—proper evidence handling procedures +- [Chapter 3: The Red Teamers Mindset](Chapter_03_The_Red_Teamers_Mindset.md) +- [Chapter 4: SOW Rules of Engagement and Client Onboarding](Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md) +- [Chapter 8: Evidence Documentation and Chain of Custody](Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md) > [!TIP] > Create your own "ethics checklist" that you review before every engagement. Include questions like: "Do I have written authorization?", "Have I identified all stakeholders?", "Do I know the escalation procedure for critical findings?" diff --git a/docs/Chapter_03_The_Red_Teamers_Mindset.md b/docs/Chapter_03_The_Red_Teamers_Mindset.md index d166ac6..8bf0c0a 100644 --- a/docs/Chapter_03_The_Red_Teamers_Mindset.md +++ b/docs/Chapter_03_The_Red_Teamers_Mindset.md @@ -154,9 +154,9 @@ Field engagements can be high-stress: production outages, tense clients, critica ### Next Steps -- **Chapter 4:** SOW, Rules of Engagement, and Client Onboarding - translate mindset into structured engagements -- **Chapter 5:** Threat Modeling and Risk Analysis - apply adversarial thinking systematically -- **Chapter 7:** Lab Setup and Environmental Safety - create practice environments for skill development +- [Chapter 4: SOW Rules of Engagement and Client Onboarding](Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md) - translate mindset into structured engagements +- [Chapter 5: Threat Modeling and Risk Analysis](Chapter_05_Threat_Modeling_and_Risk_Analysis.md) - apply adversarial thinking systematically +- [Chapter 7: Lab Setup and Environmental Safety](Chapter_07_Lab_Setup_and_Environmental_Safety.md) - create practice environments for skill development > [!TIP] > Maintain a personal "attack pattern library" where you document creative approaches, failed attempts, and successful chains. This becomes your competitive advantage over time. diff --git a/docs/Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md b/docs/Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md index a5f8ecc..8eb3447 100644 --- a/docs/Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md +++ b/docs/Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md @@ -189,9 +189,9 @@ Before you start: ### Next Steps -- **Chapter 5:** Threat Modeling and Risk Analysis - identify what matters most before attacking -- **Chapter 6:** Scoping an Engagement - practical methods for defining realistic scope -- **Chapter 8:** Evidence, Documentation, and Chain of Custody - maintain proof of authorized activity +- [Chapter 5: Threat Modeling and Risk Analysis](Chapter_05_Threat_Modeling_and_Risk_Analysis.md) - identify what matters most before attacking +- [Chapter 6: Scoping an Engagement](Chapter_06_Scoping_an_Engagement.md) - practical methods for defining realistic scope +- [Chapter 8: Evidence Documentation and Chain of Custody](Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md) - maintain proof of authorized activity > [!TIP] > Create a "pre-flight checklist" that you review before every engagement starts. Include: SOW signed? RoE documented? Access provisioned? Emergency contacts confirmed? Never skip this step. diff --git a/docs/Chapter_05_Threat_Modeling_and_Risk_Analysis.md b/docs/Chapter_05_Threat_Modeling_and_Risk_Analysis.md index 3211b1a..d2dca3c 100644 --- a/docs/Chapter_05_Threat_Modeling_and_Risk_Analysis.md +++ b/docs/Chapter_05_Threat_Modeling_and_Risk_Analysis.md @@ -178,8 +178,8 @@ As AI systems become more complex with multi-modal capabilities, agentic behavio ### Next Steps -- Chapter 6: Scoping an Engagement—translating threat models into actionable testing plans -- Chapter 9: LLM Architectures and System Components—understanding the technical foundation for identifying attack surfaces -- Chapter 31: AI System Reconnaissance—applying threat modeling insights to gather intelligence during engagements +- [Chapter 6: Scoping an Engagement](Chapter_06_Scoping_an_Engagement.md) +- [Chapter 9: LLM Architectures and System Components](Chapter_09_LLM_Architectures_and_System_Components.md) +- [Chapter 31: AI System Reconnaissance](Chapter_31_AI_System_Reconnaissance.md) --- diff --git a/docs/Chapter_06_Scoping_an_Engagement.md b/docs/Chapter_06_Scoping_an_Engagement.md index 43eab6b..6f2d8cc 100644 --- a/docs/Chapter_06_Scoping_an_Engagement.md +++ b/docs/Chapter_06_Scoping_an_Engagement.md @@ -145,8 +145,8 @@ As AI systems grow in complexity and integration depth, scoping will become more ### Next Steps -- Chapter 7: Lab Setup and Environmental Safety—creating secure testing environments within the defined scope -- Chapter 4: SOW, Rules of Engagement, and Client Onboarding—reviewing the contractual framework that supports scoping +- [Chapter 7: Lab Setup and Environmental Safety](Chapter_07_Lab_Setup_and_Environmental_Safety.md) +- [Chapter 4: SOW Rules of Engagement and Client Onboarding](Chapter_04_SOW_Rules_of_Engagement_and_Client_Onboarding.md) - Practice: Develop scoping documents for hypothetical AI engagements to refine your scoping process --- diff --git a/docs/Chapter_07_Lab_Setup_and_Environmental_Safety.md b/docs/Chapter_07_Lab_Setup_and_Environmental_Safety.md index e345d71..278582b 100644 --- a/docs/Chapter_07_Lab_Setup_and_Environmental_Safety.md +++ b/docs/Chapter_07_Lab_Setup_and_Environmental_Safety.md @@ -139,8 +139,8 @@ Expect to see standardized AI red teaming lab templates, infrastructure-as-code ### Next Steps -- Chapter 8: Evidence Documentation and Chain of Custody—capturing and preserving findings from your lab environment -- Chapter 14: Prompt Injection—applying lab skills to test a specific attack vector +- [Chapter 8: Evidence Documentation and Chain of Custody](Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md) +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) - Practice: Set up a minimal LLM testing environment using the checklists provided --- diff --git a/docs/Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md b/docs/Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md index af29502..1cfc236 100644 --- a/docs/Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md +++ b/docs/Chapter_08_Evidence_Documentation_and_Chain_of_Custody.md @@ -158,8 +158,8 @@ Expect to see automated evidence collection tools integrated into red team platf ### Next Steps -- Chapter 9: LLM Architectures and System Components—understanding systems you'll be documenting -- Chapter 36: Reporting and Communication—transforming raw evidence into effective reports +- [Chapter 9: LLM Architectures and System Components](Chapter_09_LLM_Architectures_and_System_Components.md) +- [Chapter 36: Reporting and Communication](Chapter_36_Reporting_and_Communication.md) - Practice: Create evidence documentation for test findings using the templates provided --- diff --git a/docs/Chapter_09_LLM_Architectures_and_System_Components.md b/docs/Chapter_09_LLM_Architectures_and_System_Components.md index db89f39..68c5a10 100644 --- a/docs/Chapter_09_LLM_Architectures_and_System_Components.md +++ b/docs/Chapter_09_LLM_Architectures_and_System_Components.md @@ -190,8 +190,8 @@ As LLM architectures evolve with mixture-of-experts, sparse attention, and multi ### Next Steps -- Chapter 10: Tokenization, Context, and Generation—deeper dive into specific attack-relevant components -- Chapter 11: Plugins, Extensions, and External APIs—understanding integration-based vulnerabilities -- Chapter 14: Prompt Injection—applying architectural knowledge to practical attacks +- [Chapter 10: Tokenization Context and Generation](Chapter_10_Tokenization_Context_and_Generation.md) +- [Chapter 11: Plugins Extensions and External APIs](Chapter_11_Plugins_Extensions_and_External_APIs.md) +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) --- diff --git a/docs/Chapter_10_Tokenization_Context_and_Generation.md b/docs/Chapter_10_Tokenization_Context_and_Generation.md index bafadb3..bebf310 100644 --- a/docs/Chapter_10_Tokenization_Context_and_Generation.md +++ b/docs/Chapter_10_Tokenization_Context_and_Generation.md @@ -153,8 +153,8 @@ Evolving tokenization approaches (character-level, byte-level, learned vocabular ### Next Steps -- Chapter 11: Plugins, Extensions, and External APIs—how context flows into external systems -- Chapter 14: Prompt Injection—applying tokenization knowledge to craft sophisticated injections +- [Chapter 11: Plugins Extensions and External APIs](Chapter_11_Plugins_Extensions_and_External_APIs.md) +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) - Practice: Experiment with tokenization using tools like spaCy or Hugging Face tokenizers --- diff --git a/docs/Chapter_11_Plugins_Extensions_and_External_APIs.md b/docs/Chapter_11_Plugins_Extensions_and_External_APIs.md index ea63f97..5a53133 100644 --- a/docs/Chapter_11_Plugins_Extensions_and_External_APIs.md +++ b/docs/Chapter_11_Plugins_Extensions_and_External_APIs.md @@ -160,8 +160,8 @@ As LLMs gain more agentic capabilities with tool use and multi-step planning, pl ### Next Steps -- Chapter 12: RAG Pipelines—understanding retrieval-based external data sources -- Chapter 17: Plugin and API Exploitation—deep dive into attacking integrated systems +- [Chapter 12: Retrieval Augmented Generation RAG Pipelines](Chapter_12_Retrieval_Augmented_Generation_RAG_Pipelines.md) +- [Chapter 17: 06 Case Studies and Defense](Chapter_17_06_Case_Studies_and_Defense.md) - Practice: Set up a test LLM with plugins and experiment with forced invocations --- diff --git a/docs/Chapter_12_Retrieval_Augmented_Generation_RAG_Pipelines.md b/docs/Chapter_12_Retrieval_Augmented_Generation_RAG_Pipelines.md index da1ab1f..535a7a4 100644 --- a/docs/Chapter_12_Retrieval_Augmented_Generation_RAG_Pipelines.md +++ b/docs/Chapter_12_Retrieval_Augmented_Generation_RAG_Pipelines.md @@ -1328,8 +1328,8 @@ As RAG systems become more sophisticated with multi-hop retrieval, cross-modal s ### Next Steps -- Chapter 13: Data Provenance and Supply Chain Security—securing the sources that feed RAG systems -- Chapter 14: Prompt Injection—combining RAG exploitation with injection techniques +- [Chapter 13: Data Provenance and Supply Chain Security](Chapter_13_Data_Provenance_and_Supply_Chain_Security.md) +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) - Practice: Set up a simple RAG pipeline and test document injection attacks --- diff --git a/docs/Chapter_13_Data_Provenance_and_Supply_Chain_Security.md b/docs/Chapter_13_Data_Provenance_and_Supply_Chain_Security.md index d154233..2d610eb 100644 --- a/docs/Chapter_13_Data_Provenance_and_Supply_Chain_Security.md +++ b/docs/Chapter_13_Data_Provenance_and_Supply_Chain_Security.md @@ -1896,9 +1896,9 @@ As AI supply chains grow more complex with model marketplaces, federated learnin ### Next Steps -- Chapter 14: Prompt Injection—understanding attacks that exploit deployed systems -- Chapter 19: Training Data Poisoning—deep dive into data-level supply chain attacks -- Chapter 26: Supply Chain Attacks on AI—advanced supply chain exploitation techniques +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) +- [Chapter 19: Training Data Poisoning](Chapter_19_Training_Data_Poisoning.md) +- [Chapter 26: Supply Chain Attacks on AI](Chapter_26_Supply_Chain_Attacks_on_AI.md) - Practice: Conduct a supply chain audit on an AI system following the framework provided --- diff --git a/docs/Chapter_14_Prompt_Injection.md b/docs/Chapter_14_Prompt_Injection.md index 03a6e48..ca5ed96 100644 --- a/docs/Chapter_14_Prompt_Injection.md +++ b/docs/Chapter_14_Prompt_Injection.md @@ -4157,9 +4157,9 @@ The understanding of prompt injection has evolved from accidental discovery to s ### Next Steps -- **Chapter 15:** Data Leakage and Extraction - attacks that often build on prompt injection foundations -- **Chapter 16:** Jailbreaks and Bypass Techniques - circumventing safety controls through advanced prompt manipulation -- **Chapter 23:** Advanced Persistence and Chaining - combining prompt injection with other attack vectors +- [Chapter 15: Data Leakage and Extraction](Chapter_15_Data_Leakage_and_Extraction.md) - attacks that often build on prompt injection foundations +- [Chapter 16: Jailbreaks and Bypass Techniques](Chapter_16_Jailbreaks_and_Bypass_Techniques.md) - circumventing safety controls through advanced prompt manipulation +- [Chapter 23: Advanced Persistence Chaining](Chapter_23_Advanced_Persistence_Chaining.md) - combining prompt injection with other attack vectors > [!TIP] > Create a "prompt injection playbook" with categories: basic override, role play, encoding, context manipulation, indirect injection. Test each category against every system to ensure comprehensive coverage. diff --git a/docs/Chapter_15_Data_Leakage_and_Extraction.md b/docs/Chapter_15_Data_Leakage_and_Extraction.md index 0f0b77d..d3cdef6 100644 --- a/docs/Chapter_15_Data_Leakage_and_Extraction.md +++ b/docs/Chapter_15_Data_Leakage_and_Extraction.md @@ -3700,9 +3700,9 @@ Layer 5: Governance ### Next Steps -- **Chapter 16:** Jailbreaks and Bypass Techniques - circumventing safety controls -- **Chapter 19:** Training Data Poisoning - attacks during the training phase -- **Chapter 20:** Model Theft and Membership Inference - advanced extraction techniques +- [Chapter 16: Jailbreaks and Bypass Techniques](Chapter_16_Jailbreaks_and_Bypass_Techniques.md) - circumventing safety controls +- [Chapter 19: Training Data Poisoning](Chapter_19_Training_Data_Poisoning.md) - attacks during the training phase +- [Chapter 20: Model Theft and Membership Inference](Chapter_20_Model_Theft_and_Membership_Inference.md) - advanced extraction techniques > [!TIP] > Create an "extraction taxonomy" mapping each attack technique to its success rate against your target systems. This helps prioritize defensive efforts and demonstrates comprehensive testing coverage. diff --git a/docs/Chapter_16_Jailbreaks_and_Bypass_Techniques.md b/docs/Chapter_16_Jailbreaks_and_Bypass_Techniques.md index e309416..ad1bb4b 100644 --- a/docs/Chapter_16_Jailbreaks_and_Bypass_Techniques.md +++ b/docs/Chapter_16_Jailbreaks_and_Bypass_Techniques.md @@ -1523,9 +1523,9 @@ RED_TEAM_BEST_PRACTICES = { ### Next Steps -- **Chapter 17:** Plugin and API Exploitation - jailbreaking through external integrations -- **Chapter 18:** Evasion, Obfuscation, and Adversarial Inputs - advanced bypass techniques -- **Chapter 14:** Prompt Injection - foundational attack technique often combined with jailbreaks +- [Chapter 17: 06 Case Studies and Defense](Chapter_17_06_Case_Studies_and_Defense.md) - jailbreaking through external integrations +- [Chapter 18: Evasion Obfuscation and Adversarial Inputs](Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md) - advanced bypass techniques +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) - foundational attack technique often combined with jailbreaks > [!TIP] > Maintain a "jailbreak effectiveness matrix" tracking success rates of each technique against different models and versions. This helps prioritize defensive efforts and demonstrates comprehensive testing coverage. diff --git a/docs/Chapter_17_06_Case_Studies_and_Defense.md b/docs/Chapter_17_06_Case_Studies_and_Defense.md index 4e83f7d..3c44001 100644 --- a/docs/Chapter_17_06_Case_Studies_and_Defense.md +++ b/docs/Chapter_17_06_Case_Studies_and_Defense.md @@ -690,9 +690,9 @@ def validate_email(email): ### Next Steps -- **Chapter 18:** Evasion, Obfuscation, and Adversarial Inputs. -- **Chapter 14:** Prompt Injection. -- **Chapter 23:** Advanced Persistence and Chaining. +- [Chapter 18: Evasion Obfuscation and Adversarial Inputs](Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md) +- [Chapter 14: Prompt Injection](Chapter_14_Prompt_Injection.md) +- [Chapter 23: Advanced Persistence Chaining](Chapter_23_Advanced_Persistence_Chaining.md) > [!TIP] > Create a "plugin attack matrix" mapping each plugin to its potential vectors (command injection, data access, etc). It ensures you don't miss anything. diff --git a/docs/Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md b/docs/Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md index 534cbfe..d62728b 100644 --- a/docs/Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md +++ b/docs/Chapter_18_Evasion_Obfuscation_and_Adversarial_Inputs.md @@ -1176,8 +1176,8 @@ Input validation is necessary but insufficient. True resilience requires **Defen ### Next Steps -- **Chapter 19**: Training Data Poisoning - attacking the model before it's even built. -- **Chapter 21**: Model DoS - moving from evasion to availability attacks. +- [Chapter 19: Training Data Poisoning](Chapter_19_Training_Data_Poisoning.md) - attacking the model before it's even built. +- [Chapter 21: Model DoS Resource Exhaustion](Chapter_21_Model_DoS_Resource_Exhaustion.md) - moving from evasion to availability attacks. --- @@ -1234,7 +1234,7 @@ Evasion attacks manipulate input prompts to bypass content filters and safety gu #### Next Steps -- **Chapter 19:** Training Data Poisoning +- [Chapter 19: Training Data Poisoning](Chapter_19_Training_Data_Poisoning.md) > [!TIP] > Organize evasion techniques by the specific defense they bypass. Test each category systematically for comprehensive coverage. diff --git a/docs/Chapter_19_Training_Data_Poisoning.md b/docs/Chapter_19_Training_Data_Poisoning.md index 055ccf3..525ff3b 100644 --- a/docs/Chapter_19_Training_Data_Poisoning.md +++ b/docs/Chapter_19_Training_Data_Poisoning.md @@ -876,8 +876,8 @@ For Red Teamers, poisoning demonstrates the critical need for Supply Chain Secur ### Next Steps -- **Chapter 20**: Model Theft - stealing the model you just verified. -- **Chapter 26**: Supply Chain Attacks - broader look at the pipeline. +- [Chapter 20: Model Theft and Membership Inference](Chapter_20_Model_Theft_and_Membership_Inference.md) - stealing the model you just verified. +- [Chapter 26: Supply Chain Attacks on AI](Chapter_26_Supply_Chain_Attacks_on_AI.md) - broader look at the pipeline. --- diff --git a/docs/Chapter_20_Model_Theft_and_Membership_Inference.md b/docs/Chapter_20_Model_Theft_and_Membership_Inference.md index 2f78b98..095d868 100644 --- a/docs/Chapter_20_Model_Theft_and_Membership_Inference.md +++ b/docs/Chapter_20_Model_Theft_and_Membership_Inference.md @@ -960,8 +960,8 @@ As models move to the edge and APIs become ubiquitous, these "grey box" attacks ### Next Steps -- **Chapter 21**: Model DoS - attacking availability instead of confidentiality. -- **Chapter 28**: AI Privacy Attacks - deeper dive into PII extraction. +- [Chapter 21: Model DoS Resource Exhaustion](Chapter_21_Model_DoS_Resource_Exhaustion.md) - attacking availability instead of confidentiality. +- [Chapter 28: AI Privacy Attacks](Chapter_28_AI_Privacy_Attacks.md) - deeper dive into PII extraction. --- diff --git a/docs/Chapter_21_Model_DoS_Resource_Exhaustion.md b/docs/Chapter_21_Model_DoS_Resource_Exhaustion.md index 45f5437..5bf5e77 100644 --- a/docs/Chapter_21_Model_DoS_Resource_Exhaustion.md +++ b/docs/Chapter_21_Model_DoS_Resource_Exhaustion.md @@ -857,8 +857,8 @@ For Red Teamers, the "DoS" category often merges with "Financial Impact." If you ### Next Steps -- **Chapter 22**: Multimodal Attacks - adding images and audio to the mix. -- **Chapter 25**: Advanced Adversarial ML - deeper mathematical attacks. +- [Chapter 22: Cross Modal Multimodal Attacks](Chapter_22_Cross_Modal_Multimodal_Attacks.md) - adding images and audio to the mix. +- [Chapter 25: Advanced Adversarial ML](Chapter_25_Advanced_Adversarial_ML.md) - deeper mathematical attacks. --- diff --git a/docs/Chapter_22_Cross_Modal_Multimodal_Attacks.md b/docs/Chapter_22_Cross_Modal_Multimodal_Attacks.md index f8eba29..0dc07cf 100644 --- a/docs/Chapter_22_Cross_Modal_Multimodal_Attacks.md +++ b/docs/Chapter_22_Cross_Modal_Multimodal_Attacks.md @@ -1219,8 +1219,8 @@ For red teamers, this is the "Golden Age" of multimodal exploits. Defenses are i ### Next Steps -- **Chapter 23**: Advanced Persistence - keeping your access after the initial exploit. -- **Chapter 24**: Social Engineering - using the AI to hack the human. +- [Chapter 23: Advanced Persistence Chaining](Chapter_23_Advanced_Persistence_Chaining.md) - keeping your access after the initial exploit. +- [Chapter 24: Social Engineering LLMs](Chapter_24_Social_Engineering_LLMs.md) - using the AI to hack the human. --- diff --git a/docs/Chapter_23_Advanced_Persistence_Chaining.md b/docs/Chapter_23_Advanced_Persistence_Chaining.md index 54fe478..02ff515 100644 --- a/docs/Chapter_23_Advanced_Persistence_Chaining.md +++ b/docs/Chapter_23_Advanced_Persistence_Chaining.md @@ -830,8 +830,8 @@ Attacking an LLM is like hacking a conversation. If you can change the _premise_ ### Next Steps -- **Chapter 24**: Social Engineering - Applying these persistence techniques to the ultimate soft target: Humans. -- **Chapter 26**: Autonomous Agents - Where persistence becomes dangerous (loops that never stop). +- [Chapter 24: Social Engineering LLMs](Chapter_24_Social_Engineering_LLMs.md) - Applying these persistence techniques to the ultimate soft target: Humans. +- [Chapter 26: Supply Chain Attacks on AI](Chapter_26_Supply_Chain_Attacks_on_AI.md) - Where persistence becomes dangerous (loops that never stop). --- diff --git a/docs/Chapter_26_Supply_Chain_Attacks_on_AI.md b/docs/Chapter_26_Supply_Chain_Attacks_on_AI.md index 4b70bbb..9cb8d0d 100644 --- a/docs/Chapter_26_Supply_Chain_Attacks_on_AI.md +++ b/docs/Chapter_26_Supply_Chain_Attacks_on_AI.md @@ -722,9 +722,9 @@ Supply chain risks will get worse as AI gets more complex. Expect more attacks o ### Next Steps -- Chapter 13: Data Provenance and Supply Chain Security (foundational concepts) -- Chapter 19: Training Data Poisoning (related attack vector) -- Chapter 27: Federated Learning Attacks (distributed supply chain risks) +- [Chapter 13: Data Provenance and Supply Chain Security](Chapter_13_Data_Provenance_and_Supply_Chain_Security.md) +- [Chapter 19: Training Data Poisoning](Chapter_19_Training_Data_Poisoning.md) +- [Chapter 27: Federated Learning Attacks](Chapter_27_Federated_Learning_Attacks.md) - Practice: Run a supply chain audit on your ML infrastructure using the tools from this chapter --- diff --git a/docs/Chapter_28_AI_Privacy_Attacks.md b/docs/Chapter_28_AI_Privacy_Attacks.md index 3592028..37365d0 100644 --- a/docs/Chapter_28_AI_Privacy_Attacks.md +++ b/docs/Chapter_28_AI_Privacy_Attacks.md @@ -439,8 +439,8 @@ Privacy-preserving ML (PPML) will likely become standard. Expect stricter regula ### Next Steps -- Chapter 29: Model Inversion Attacks -- Chapter 30: Backdoor Attacks +- [Chapter 29: Model Inversion Attacks](Chapter_29_Model_Inversion_Attacks.md) +- [Chapter 30: Backdoor Attacks](Chapter_30_Backdoor_Attacks.md) - Practice: Use the `text-attack` library to simulate extraction. --- diff --git a/docs/Chapter_29_Model_Inversion_Attacks.md b/docs/Chapter_29_Model_Inversion_Attacks.md index 1f420ec..05103c1 100644 --- a/docs/Chapter_29_Model_Inversion_Attacks.md +++ b/docs/Chapter_29_Model_Inversion_Attacks.md @@ -405,8 +405,8 @@ Fredrikson et al. showed that by observing the predicted dosage of Warfarin and ### Next Steps -- Chapter 30: Backdoor Attacks -- Chapter 31: AI System Reconnaissance +- [Chapter 30: Backdoor Attacks](Chapter_30_Backdoor_Attacks.md) +- [Chapter 31: AI System Reconnaissance](Chapter_31_AI_System_Reconnaissance.md) - Practice: Try the GMI (Generative Model Inversion) lab on GitHub. --- diff --git a/docs/Chapter_30_Backdoor_Attacks.md b/docs/Chapter_30_Backdoor_Attacks.md index 6fb955d..68af8a9 100644 --- a/docs/Chapter_30_Backdoor_Attacks.md +++ b/docs/Chapter_30_Backdoor_Attacks.md @@ -376,8 +376,8 @@ Researchers used model editing (ROME) to surgically implant a fact ("The Eiffel ### Next Steps -- Chapter 31: AI System Reconnaissance -- Chapter 32: Automated Attack Frameworks +- [Chapter 31: AI System Reconnaissance](Chapter_31_AI_System_Reconnaissance.md) +- [Chapter 32: Automated Attack Frameworks](Chapter_32_Automated_Attack_Frameworks.md) - Practice: Use the TrojAI dataset to practice backdoor detection. --- diff --git a/docs/Chapter_31_AI_System_Reconnaissance.md b/docs/Chapter_31_AI_System_Reconnaissance.md index c452e22..a2f025c 100644 --- a/docs/Chapter_31_AI_System_Reconnaissance.md +++ b/docs/Chapter_31_AI_System_Reconnaissance.md @@ -366,8 +366,8 @@ Red teamers noticed that questions about "Q3 Earnings" took 200ms longer than "H ### Next Steps -- Chapter 32: Automated Attack Frameworks -- Chapter 33: Red Team Automation +- [Chapter 32: Automated Attack Frameworks](Chapter_32_Automated_Attack_Frameworks.md) +- [Chapter 33: Red Team Automation](Chapter_33_Red_Team_Automation.md) - Practice: Use `fuzz-llm` to probe for model identity. --- diff --git a/docs/Chapter_32_Automated_Attack_Frameworks.md b/docs/Chapter_32_Automated_Attack_Frameworks.md index 539718f..5ce9752 100644 --- a/docs/Chapter_32_Automated_Attack_Frameworks.md +++ b/docs/Chapter_32_Automated_Attack_Frameworks.md @@ -395,8 +395,8 @@ While not a unified script, the collective action of 4chan users acted as a dist ### Next Steps -- Chapter 33: Red Team Automation (CI/CD integration) -- Chapter 34: Defense Evasion Techniques +- [Chapter 33: Red Team Automation](Chapter_33_Red_Team_Automation.md) +- [Chapter 34: Defense Evasion Techniques](Chapter_34_Defense_Evasion_Techniques.md) - Practice: Write a fuzzer that tests for SQL Injection prompts in an LLM. --- diff --git a/docs/Chapter_33_Red_Team_Automation.md b/docs/Chapter_33_Red_Team_Automation.md index 6a9c1c6..361fdd8 100644 --- a/docs/Chapter_33_Red_Team_Automation.md +++ b/docs/Chapter_33_Red_Team_Automation.md @@ -340,8 +340,8 @@ DevOps changed the RAG retrieval limit from 5 to 50 chunks for performance. This ### Next Steps -- Chapter 34: Defense Evasion Techniques -- Chapter 38: Continuous Red Teaming +- [Chapter 34: Defense Evasion Techniques](Chapter_34_Defense_Evasion_Techniques.md) +- [Chapter 38: Continuous Red Teaming](Chapter_38_Continuous_Red_Teaming.md) - Practice: Add a GitHub Action to your repo that runs `garak` on push. --- diff --git a/docs/Chapter_34_Defense_Evasion_Techniques.md b/docs/Chapter_34_Defense_Evasion_Techniques.md index 4bdf167..c766da6 100644 --- a/docs/Chapter_34_Defense_Evasion_Techniques.md +++ b/docs/Chapter_34_Defense_Evasion_Techniques.md @@ -327,8 +327,8 @@ Researchers found that translating toxic prompts into Pig Latin or uncommon lang ### Next Steps -- Chapter 35: Post-Exploitation in AI Systems -- Chapter 21: Model DoS +- [Chapter 35: Post-Exploitation in AI Systems](Chapter_35_Post-Exploitation_in_AI_Systems.md) +- [Chapter 21: Model DoS Resource Exhaustion](Chapter_21_Model_DoS_Resource_Exhaustion.md) - Practice: Use the `PayloadSplitter` to bypass a simple regex filter. --- diff --git a/docs/Chapter_35_Post-Exploitation_in_AI_Systems.md b/docs/Chapter_35_Post-Exploitation_in_AI_Systems.md index 22fd159..ff22d45 100644 --- a/docs/Chapter_35_Post-Exploitation_in_AI_Systems.md +++ b/docs/Chapter_35_Post-Exploitation_in_AI_Systems.md @@ -331,8 +331,8 @@ An attacker sent an email containing white text (invisible to humans) saying: "I ### Next Steps -- Chapter 36: Reporting and Communication -- Chapter 38: Continuous Red Teaming +- [Chapter 36: Reporting and Communication](Chapter_36_Reporting_and_Communication.md) +- [Chapter 38: Continuous Red Teaming](Chapter_38_Continuous_Red_Teaming.md) - Practice: Deploy a vulnerable RAG app and try to implant a persistent "Hello World" message. --- diff --git a/docs/Chapter_40_Compliance_and_Standards.md b/docs/Chapter_40_Compliance_and_Standards.md index 135bb62..af90898 100644 --- a/docs/Chapter_40_Compliance_and_Standards.md +++ b/docs/Chapter_40_Compliance_and_Standards.md @@ -304,8 +304,8 @@ Compliance auditing is the "Blue Team" side of "Red Teaming." It turns the excit ### Next Steps -- **Chapter 41:** Industry Best Practices (Implementing the defenses we just audited). -- **Chapter 42:** Case Studies (Real-world failures). +- [Chapter 41: Industry Best Practices](Chapter_41_Industry_Best_Practices.md) +- [Chapter 42: Case Studies and War Stories](Chapter_42_Case_Studies_and_War_Stories.md) --- diff --git a/docs/Chapter_41_Industry_Best_Practices.md b/docs/Chapter_41_Industry_Best_Practices.md index 67f8bdd..39aec11 100644 --- a/docs/Chapter_41_Industry_Best_Practices.md +++ b/docs/Chapter_41_Industry_Best_Practices.md @@ -302,5 +302,5 @@ Best practices in AI security are about **assuming breach**. The model is untrus ### Next Steps -- **Chapter 42:** Case Studies - Seeing how these defenses failed in the real world. +- [Chapter 42: Case Studies and War Stories](Chapter_42_Case_Studies_and_War_Stories.md) - Seeing how these defenses failed in the real world. - **Practice:** Implement the `TokenBucket` in your own API wrapper. diff --git a/docs/Chapter_42_Case_Studies_and_War_Stories.md b/docs/Chapter_42_Case_Studies_and_War_Stories.md index 2bd3c02..85161ee 100644 --- a/docs/Chapter_42_Case_Studies_and_War_Stories.md +++ b/docs/Chapter_42_Case_Studies_and_War_Stories.md @@ -223,5 +223,5 @@ These stories share a common thread: **Trust**. In each case, the system trusted ### Next Steps -- **Chapter 43:** Future of AI Red Teaming. +- [Chapter 43: Future of AI Red Teaming](Chapter_43_Future_of_AI_Red_Teaming.md) - **Practice:** Try to create an "Invisible Prompt" in a PDF (white text) and ask a PDF-chat tool to summarize it. diff --git a/docs/Chapter_43_Future_of_AI_Red_Teaming.md b/docs/Chapter_43_Future_of_AI_Red_Teaming.md index 82701ed..103eb06 100644 --- a/docs/Chapter_43_Future_of_AI_Red_Teaming.md +++ b/docs/Chapter_43_Future_of_AI_Red_Teaming.md @@ -149,5 +149,5 @@ The "Future" is already here in the research labs. As a Red Teamer, you must rea ### Next Steps -- **Chapter 44:** Emerging Threats (Shadow AI). +- [Chapter 44: Emerging Threats](Chapter_44_Emerging_Threats.md) - **Practice:** Run the `text-attack` Python library to generate adversarial examples against a small BERT model. diff --git a/docs/Chapter_44_Emerging_Threats.md b/docs/Chapter_44_Emerging_Threats.md index ccf30ee..8764766 100644 --- a/docs/Chapter_44_Emerging_Threats.md +++ b/docs/Chapter_44_Emerging_Threats.md @@ -204,5 +204,5 @@ Emerging threats require emerging defenses. We are no longer just securing the p ### Next Steps -- **Chapter 45:** Building a formal Red Team Program. +- [Chapter 45: Building an AI Red Team Program](Chapter_45_Building_an_AI_Red_Team_Program.md) - **Practice:** Run `nmap -p 11434 192.168.1.0/24` on your home network. You might be surprised. diff --git a/docs/Chapter_45_Building_an_AI_Red_Team_Program.md b/docs/Chapter_45_Building_an_AI_Red_Team_Program.md index 94e6c87..e164ecf 100644 --- a/docs/Chapter_45_Building_an_AI_Red_Team_Program.md +++ b/docs/Chapter_45_Building_an_AI_Red_Team_Program.md @@ -183,5 +183,5 @@ Building an AI Red Team is building an "Immune System." It is not a project that ### Next Steps -- **Chapter 46:** Conclusion. +- [Chapter 46: Conclusion and Next Steps](Chapter_46_Conclusion_and_Next_Steps.md) - **Action:** Build your cost model. Calculate the price of running `garak` against your main application today. diff --git a/scripts/link_next_steps.py b/scripts/link_next_steps.py new file mode 100644 index 0000000..dc4f0b6 --- /dev/null +++ b/scripts/link_next_steps.py @@ -0,0 +1,107 @@ + +import os +import re + +DOCS_DIR = 'docs' + +def get_chapter_map(): + chapter_map = {} + for filename in sorted(os.listdir(DOCS_DIR)): + if filename.startswith('Chapter_') and filename.endswith('.md'): + # Extract chapter number + match = re.search(r'Chapter_(\d+)', filename) + if match: + num = int(match.group(1)) + # Extract title from filename (remove Chapter_XX_ and .md) + # Chapter_25_Advanced_Adversarial_ML.md -> Advanced Adversarial ML + title_part = filename[len(match.group(0)) + 1 : -3] + title = title_part.replace('_', ' ') + chapter_map[num] = { + 'filename': filename, + 'title': title + } + return chapter_map + +def update_chapter(filepath, chapter_map): + with open(filepath, 'r') as f: + content = f.read() + + # Find Next Steps section + # Valid headers: ## Next Steps, ### Next Steps + lines = content.split('\n') + new_lines = [] + modified = False + + in_next_steps = False + + for line in lines: + if re.match(r'^#+\s+Next Steps', line, re.IGNORECASE): + in_next_steps = True + new_lines.append(line) + continue + + if in_next_steps: + # Stop looking if we hit another header + if line.startswith('#'): + in_next_steps = False + new_lines.append(line) + continue + + # Check for Chapter links to update + # Pattern: - [**]Chapter (\d+)[**]: Title - Description + # Capture spaces/stars optionally + match = re.search(r'^(\s*-\s*)(?:\*\*)?Chapter (\d+)(?:\*\*)?:\s*(.*?)(?=\s+-\s|$)', line) + + if match: + prefix = match.group(1) # "- " + chap_num = int(match.group(2)) + current_text_title = match.group(3) + + # Check if already linked + if '[' in line and '](' in line: + new_lines.append(line) + continue + + if chap_num in chapter_map: + target = chapter_map[chap_num] + # Format: - [Chapter 25: Advanced Adversarial ML](Chapter_25_Advanced_Adversarial_ML.md) + # Preserve description if it exists + # The regex captured up to " - " or end of line. + # We need to append the rest of the line (description) + + # Let's rebuild the line + # Find where the title ends (separator " - " or end) + rest_of_line = line[match.end():] + + new_line = f"{prefix}[Chapter {chap_num}: {target['title']}]({target['filename']}){rest_of_line}" + new_lines.append(new_line) + modified = True + print(f"Updated Ch {chap_num} link in {os.path.basename(filepath)}") + else: + new_lines.append(line) + else: + new_lines.append(line) + else: + new_lines.append(line) + + if modified: + with open(filepath, 'w') as f: + f.write('\n'.join(new_lines)) + return True + return False + +def main(): + chapter_map = get_chapter_map() + print(f"Found {len(chapter_map)} chapters.") + + count = 0 + for filename in sorted(os.listdir(DOCS_DIR)): + if filename.startswith('Chapter_') and filename.endswith('.md'): + filepath = os.path.join(DOCS_DIR, filename) + if update_chapter(filepath, chapter_map): + count += 1 + + print(f"Modified {count} files.") + +if __name__ == '__main__': + main()