Practice on permitted targets

There Is Always a Place to Test Your Skills

Every technique in this 24-lesson course targets the mathematical structure of post-training alignment, not a specific prohibited topic.

Whether you want to go full-contact against hardened frontier guardrails in sanctioned red-teaming arenas, isolate wrapper classifiers from internal RLHF weights, or test sycophancy and arbitrary refusal boundaries, the rule is the same: the target is either an arena that invites the attack within its stated scope, or a model you run yourself.

1. Full-Contact Red-Teaming & CTF Arenas

These platforms are built specifically for adversarial testing. Within the active challenge scopes, your job is to break the model or extract the target behavior, no walking on eggshells required:

Gray Swan AI Arena¹

• What it gives you: Live, competitive red-teaming challenges against frontier models (and novel defenses like Representation Circuit Breakers) spanning jailbreaks, ideological/policy edge cases, confidential system extraction, and agentic tool abuse. Within active arena challenges, the gloves are off.
• Best Course Techniques to Run Here:
• Ephemeral Domain Bijections & Custom AST DSLs (Card 3, 01)
• 4-Turn Crescendo Walks with Context Backtracking (Card 3, 02)
• Broken-Code Linter Traps & Competing Objectives (Card 2, 02)
• CoT Reasoning Starvation & Axiom Framing (Card 1, 05)

Lakera Gandalf²

• What it gives you: A fast, multi-level sandbox designed to test instruction-hierarchy overrides, input keyword guardrails, and streaming output filters protecting a secret password.
• Best Course Techniques to Run Here:
• Full-Stack Layer Fingerprinting (Input vs. Weights vs. Output Filter) (Card 1, 06)
• BPE Subword Splitting, Character Delimiters & Homoglyphs (Card 3, 05)
• Syntactic CSV / SQL / Translation Lock (Card 1, 03)

2. Cloud Evaluation Suites & Developer Consoles

Cloud consoles (Google AI Studio, Azure AI Foundry, OpenAI Playground) expose gray-box telemetry like logprobs, adjustable safety-filter thresholds, and fine-tuning. Those features are for evaluating your own tenant or account within the provider's terms, not for attacking the provider's hosted models.

(redacted: a directory of specific course attack techniques mapped onto Google AI Studio, Microsoft Azure AI Foundry, and OpenAI Playground as targets. Use these consoles only against your own tenant/account content, within terms.)

3. Live Preference & Blind Comparison Arenas

(redacted: a mapping of course attack techniques onto LMArena as a target.)

4. Local & Colab White-Box Sandboxes

Google Colab (Free T4 GPU) / Local vLLM + HuggingFace

• What it gives you: 100% unrestricted read/write access to model weights (.safetensors), intermediate layer activations (output_hidden_states=True), tokenizers, and LoRA adapters on open-weight models (Qwen2.5-Instruct, Llama-3.1/3.2-Instruct, Gemma-2-It, Mistral-Instruct) that you run yourself. This is the right place to study internals: you own the model and nothing leaves your machine.

(redacted: a list of white-box offensive procedures to run here, abliteration, LoRA alignment-undo, GCG suffix optimization, and preference-poisoning / sleeper-trigger injection.)

Quick-Reference: Matching the Skill to the Sandbox

(redacted: a full matrix mapping every course technique to a primary proving ground, most entries pointing attacks at third-party hosted consoles.)