--- title: G5 Eval Dashboard emoji: 🛡️ colorFrom: blue colorTo: green sdk: docker pinned: false --- # LLM Prompt Injection Security Evaluation Framework This repository contains the capstone framework for evaluating prompt injection attacks against LLM systems, applying mitigations, and comparing security outcomes before and after defense. ## Project State The current branch reflects a usable end-to-end research framework: - a stable schema for datasets, configs, and run artifacts - an active normalized corpus built from HackAPrompt and TensorTrust - runnable model adapters for `mock`, `groq`, and `ollama` - category-aware evaluation and scoring - a mitigation layer integrated into the runner - baseline-vs-defended comparison workflows - a polished HTML dashboard for presentation and a lightweight Streamlit dashboard for interactive exploration This is a capstone evaluation framework, not a production security product. ## Scope ### In scope - attack scenario design and normalization - LLM vulnerability evaluation - mitigation implementation - comparative measurement and reporting ### Out of scope - training new foundation models - building a consumer chatbot product - large-scale model training infrastructure ## Repository Structure - `src/prompt_injection_framework/attacks/`: attack logic and generators - `src/prompt_injection_framework/mitigations/`: request and response defenses - `src/prompt_injection_framework/models/`: model adapters - `src/prompt_injection_framework/evaluation/`: scoring and metrics - `src/prompt_injection_framework/orchestration/`: experiment runner and config loading - `configs/`: runnable experiment configurations - `dashboard/`: optional Streamlit app for interactive artifact exploration - `tests/`: automated validation - `docs/`: project, methodology, workflow documentation, and the HTML dashboard ## Active Data State - Active normalized sources: - HackAPrompt: `1,000` curated cases - TensorTrust: `1,346` curated cases - Active corpus files: - `data/normalized/attack_cases.jsonl` - `data/normalized/attack_cases.enriched.jsonl` - Total active normalized corpus: - `2,346` cases AgentDojo remains a reference source but is not part of the active experiment corpus in the current project state. Supplemental validation coverage: - `data/normalized/supplemental_validation_cases.jsonl` - `6` project-authored cases - covers benign-control utility checks and indirect/tool-mediated prompt injection checks - kept separate so the benchmark corpus is not modified or reinterpreted ## Supported Model Providers - `mock` - for fast validation and testing - `groq` - for hosted real-model experiments - `ollama` - for local/open-source model experiments More detail is documented in `docs/PHASE4_BASELINE_MODELS.md`. ## Execution Pipeline 1. Load normalized cases 2. Filter and sample the experiment slice 3. Map cases into taxonomy-aware experiment records 4. Build model requests 5. Apply mitigation if enabled 6. Run the model or mitigation block path 7. Apply response mitigation 8. Score outputs 9. Save manifest, case results, and summary artifacts ## Quick Start ### Environment setup ```bash python3 -m venv .venv source .venv/bin/activate pip install -U pip pip install -e .[dev] ``` ### Run a baseline experiment ```bash python -m prompt_injection_framework.orchestration.run_experiment --config configs/baseline.yaml ``` ### Run tests ```bash pytest ``` ### Open the HTML dashboard Open `docs/project_dashboard.html` directly in a browser for the stable demo view. This is the recommended dashboard for tutor/client presentation because it summarises the latest four-model results, mitigation type, scorer fixes, and the scoped interpretation of the 0% TensorTrust extraction result. ### Run the optional Streamlit dashboard ```bash pip install -e .[dashboard] streamlit run dashboard/streamlit_app.py ``` ## Core Experiment Configs ### Baseline and evaluation slices - `configs/active_corpus_smoke_40.yaml` - `configs/hackaprompt_override_25.yaml` - `configs/hackaprompt_leakage_20.yaml` - `configs/tensortrust_hijacking_25.yaml` - `configs/tensortrust_extraction_25.yaml` ### Defended counterparts - `configs/hackaprompt_override_25_mitigated.yaml` - `configs/tensortrust_hijacking_25_mitigated.yaml` - `configs/tensortrust_extraction_25_mitigated.yaml` - `configs/hackaprompt_direct_10_mitigated.yaml` - `configs/agentdojo_tool_10_mitigated.yaml` - `configs/hackaprompt_adaptive_1_mitigated.yaml` - `configs/supplemental_indirect_benign_6_mitigated.yaml` ### Mock validation pairs - `configs/hackaprompt_override_25_mock.yaml` - `configs/hackaprompt_override_25_mock_mitigated.yaml` - `configs/tensortrust_hijacking_25_mock.yaml` - `configs/tensortrust_hijacking_25_mock_mitigated.yaml` - `configs/hackaprompt_direct_10_mock.yaml` - `configs/hackaprompt_direct_10_mock_mitigated.yaml` - `configs/agentdojo_tool_10_mock.yaml` - `configs/agentdojo_tool_10_mock_mitigated.yaml` - `configs/supplemental_indirect_benign_6_mock.yaml` - `configs/supplemental_indirect_benign_6_mock_mitigated.yaml` ### Local/open-source baselines - `configs/ollama_llama_hackaprompt_override_25.yaml` - `configs/ollama_qwen_tensortrust_hijacking_25.yaml` ## Mitigation Layer Supported strategies: - `none` - `prompt_hardening` - `instruction_isolation` - `keyword_guardrail` - `surface_aligned` `surface_aligned` is the main defended path for the current framework because it routes by attack surface and category, records mitigation behavior in the artifacts, and supports before-vs-after comparisons directly in the runner. More detail is documented in `docs/MITIGATION_LAYER.md`. ## Evaluation and Comparison The framework currently supports: - attack success rate - prompt leakage tracking - refusal tracking - benign utility and false-positive reporting - category, surface, and source breakdowns - baseline-vs-defended comparison outputs in JSON and Markdown Useful documentation: - `docs/PHASE5_BASELINE_EVALUATION.md` - `docs/PHASE7_EXPERIMENT_GUIDE.md` - `docs/GROQ_RUNBOOK.md` - `docs/RESULTS_TEMPLATE.md` ## Dashboard The repository includes two dashboard options: - `docs/project_dashboard.html` - static, polished HTML dashboard for demos and report screenshots - includes the latest four-model results, mitigation type per defended run, and solved dates for scorer issues - clearly scopes the 0% mitigated TensorTrust extraction ASR result to the tested extraction slice only - `dashboard/streamlit_app.py` - optional interactive dashboard for exploring saved experiment artifacts The Streamlit app presents run summaries, baseline-vs-defended comparisons, category/surface/source breakdowns, and case-level inspection views. See `docs/DASHBOARD_GUIDE.md`. ## Notes - The schema contract is documented in `docs/SCHEMA_CONTRACT.md`. - The taxonomy contract is documented in `docs/ATTACK_TAXONOMY.md`. - Success criteria are documented in `docs/SUCCESS_CRITERIA.md`. - The current system is strong enough for capstone experiments, but real-model evaluation still shows that some benchmark slices benefit from additional mitigation refinement.