ATK — Attacker mission
Bend the model to your will: inject instructions through untrusted input, craft adversarial examples that evade detection, and poison the data that trains it.
Adversarial AI Cyber Range Training
AI is now part of the attack surface — and most teams have never practised attacking or defending it.
DEF — Defender mission
Validate and isolate untrusted input, constrain tool use, monitor for evasion and prompt-injection, and keep the training pipeline trustworthy.
AI — What the Coach reviews
Whether your injection bypassed the guardrail, how you constrained the model’s tools, and which ATLAS techniques showed up in your run.
MITRE ATLAS techniques covered
- AML.T0051 LLM Prompt Injection
- AML.T0043 Craft Adversarial Data
- AML.T0020 Poison Training Data
- AML.T0024 Exfiltration via ML Inference API
- AML.T0054 LLM Jailbreak
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- Real-world LLM prompt-injection against assistant and agent apps that act on untrusted web content.
- Microsoft Tay (2016) — a chatbot poisoned into hostile output within hours of launch.
- Adversarial-example research repeatedly fooling production image and malware classifiers.
Attack. Defend. Repeat.