AI/ML Pentesting Roadmap for Beginners

Welcome to the roadmap for learning AI/ML pentesting from scratch! This guide will take you through the essentials of AI/ML security, focusing on prompt injection attacks, LLM security, and more. Follow these steps to build a solid foundation and advance your skills.

Table of Contents

• Introduction to AI/ML Security
• Understanding Prompt Injection
• Hands-On Practice
• Advanced Topics
• Additional Resources

Introduction to AI/ML Security

1. Learn the Basics of AI/ML

   • AI/ML Concepts
   • Introduction to Machine Learning
   • Basic AI/ML Security Concepts

2. Understand AI/ML Security Fundamentals

   • The Ultimate Guide to Managing Ethical and Security Risks in AI
   • From MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms

Understanding Prompt Injection

1. Explore Prompt Injection Basics

   • IBM's Guide on Prompt Injection
   • Learn Prompting - Prompt Hacking and Injection
   • Simon Willison's Explanation

2. Dive into Advanced Prompt Injection Topics

   • Bugcrowd's Deep Dive
   • NCC Group Research on Prompt Injection
   • Prompt Injection Analysis by JFrog

Hands-On Practice

1. Interactive Tools and Platforms

   • Gandalf - LLM Prompt Testing
   • Prompt Airlines - Gamified Learning
   • Crucible - Interactive Scenarios
   • Immersive Labs for AI Security

2. Repositories & Projects

   • WithSecureLabs - Damn Vulnerable LLM Agent
   • ScottLogic Prompt Injection Playground
   • Greshake LLM Security Tools
   • Awesome LLM Security List

Advanced Topics

1. Deepen Your Knowledge

   • LLM Pentest: Agent Integration for RCE
   • How to Persuade an LLM to Change Its System Prompt
   • CTF Writeup - LLM Edition

2. Research and Real-World Exploits

   • Google AI Studio Data Exfiltration
   • Shelltorch Vulnerabilities in Torchserve
   • My LLM Bug Bounty Journey

Additional Resources

• LLM Hacker's Handbook
• PayloadAllTheThings
• AI Exploits Repository
• Google Gemini Vulnerability Research
• OpenAI Allowed Unlimited Credit on New Accounts
• YT / Penetration Testing against and with AI/LLM/ML
• WideOpenAI
• Chatgpt-DAN
• Payloads for Attacking Large Language Models (PALLMs)