Red-Team Dojo
Fire a seeded attack at a target agent — prompt injection, a jailbreak, a secret-exfiltration prompt, a toxicity bait — and watch it land or get blocked as you switch guardrails on. The moat is what happens after a win: every attack that lands is minted into a short regression test and pinned to the target's own suite, so the dojo visibly gets harder after each success. A side-by-side X-ray shows the model's raw pre-filter output next to what the guardrail actually caught, making the normally invisible moderation layer visible. Runs entirely in your browser (0 uploads, works offline).
How to use it
- Choose an attack from the six seeded exploits — each is tagged by category (injection, jailbreak, leak, toxicity) and shows its raw payload.
- Read the verdict — with no defenses on, the attack lands. The banner names why and hints which single guardrail stops it.
- Harden the target by toggling guardrails. Turn on the one built for that category and the exploit flips to Blocked; turn on only the ones it beats and it still lands.
- Open the X-ray to compare the raw model output against what the guardrail blocked, then pin the landed attack as a regression test and watch the suite grow.
What this clears up (the fundamentals)
- A guardrail is category-specific, not a magic shield — an input sanitizer catches injected instructions but does nothing for a jailbroken persona; output moderation catches toxicity but not a leaked key. Each attack here is stopped by exactly one countermeasure, so you feel which defense does which job.
- Defense-in-depth is why you stack them — one guardrail leaves three doors open. Only by layering the four do you cover injection, jailbreak, leak, and toxicity at once.
- Red-teaming is iteration, not a one-shot audit — you break it, you patch it, you re-break it. Turning a win into a regression test is how that loop compounds instead of evaporating.
- The moderation layer is a real, inspectable stage — the model's raw output and the filtered output are two different things. Seeing them side by side demystifies "the AI refused" into "the guardrail scored this and blocked it."
Where it's used
A top-of-funnel AI-engineering security check and the fastest way to feel why prompt injection and jailbreaks are different problems that need different guardrails. It's a miatz build-lab concept playable feeding module AIE-304: play the seeded dojo here, then learn to build the attack console, the guardrail scoring, and the live regression suite yourself.
FAQ
What's the difference between injection and a jailbreak?
Prompt injection smuggles new instructions into the model's input — often hidden inside a pasted document or tool result — to hijack what it does. A jailbreak doesn't inject commands so much as talk the model out of its own rules with role-play or emotional framing. They slip past different guardrails, which is exactly what the dojo makes you feel.
How does an attack become a regression test?
When an attack lands, the dojo generates a short test case: the payload, the category, and the assertion that the target must refuse or sanitize it — plus the defense that would make it pass. Pin it and it joins the suite, so the next run has to survive every exploit you've already found.
Is this running a real model?
No. This is a seeded teaching mode — the attacks, the pass/fail logic, and the raw-vs-guarded outputs are all scripted and deterministic, so the same attack always resolves the same way. Live BYOK inference against a sandboxed target is a separate mode (see Limits).
Is anything uploaded?
No. Every attack, defense toggle, and pinned regression case is computed entirely in your browser — nothing is transmitted, stored, or logged. Turn off your Wi-Fi and it still works.
Why does the wrong defense do nothing?
Because a guardrail only covers the attack it was built for. Enabling output moderation against a prompt-injection payload changes nothing — the injected instruction never reaches the moderated output. That "did nothing" moment is the lesson: match the defense to the threat.
Limits
This is a seeded demo with six fixed attacks and four fixed guardrails — a fast, honest model of how attack-defense iteration works, not a live pentest of your own agent. Real red-teaming runs against an actual model with open-ended, multi-turn payloads and fuzzed variations. Live BYOK inference against an isolated, egress-blocked sandbox (with a per-run cost meter, keys browser-to-provider and never stored) is a separate future mode; the loop it teaches — break, mint a regression test, re-harden — is exactly the real practice.
Related
Part of the Demystify Playgrounds. Explore the rest from the Playgrounds home.
Bookmark this page (Ctrl+D, or ⌘D on Mac) — it works offline the next time you need it.