Offensive-AI Framework

A structured, hands-on framework for AI red teaming, adversarial machine learning, and LLM security research — mapped to OWASP ML Top 10, OWASP LLM Top 10, and Google's Secure AI Framework (SAIF).

---

About

The Offensive-AI Framework is an open knowledge base and practical reference for security professionals, red teamers, and researchers working at the intersection of artificial intelligence and offensive security.

The field of AI security is rapidly evolving. Models are being deployed as autonomous agents, integrated into critical infrastructure, and trusted to make consequential decisions. This framework documents the attack techniques, vulnerabilities, and research needed to stress-test these systems — before adversaries do.

The framework is built on three industry-standard foundations:

• OWASP ML Security Top 10 — adversarial risks across the machine learning lifecycle
• OWASP LLM Top 10 — security risks specific to Large Language Model applications
• Google Secure AI Framework (SAIF) — a lifecycle-based model for understanding the full AI attack surface

Each section maps offensive techniques to these frameworks, providing structured payloads, lab walkthroughs, tools, and references for practitioners.

Framework Foundations

OWASP ML Security Top 10

The OWASP ML Top 10 covers the most critical security risks across the full machine learning pipeline — from data collection and training to model deployment and inference. These risks apply to classical ML systems (Naive Bayes, SVMs, gradient boosting) and deep learning alike.

OWASP LLM Top 10

The OWASP LLM Top 10 focuses on security risks that emerge specifically from the deployment and operation of Large Language Model applications — including risks unique to generative AI such as prompt injection, hallucination, and excessive agency.

Google Secure AI Framework (SAIF)

Google's SAIF, introduced in 2023, provides a holistic framework for securing the entire AI pipeline — from data collection through model deployment and application integration. Where OWASP provides targeted vulnerability checklists, SAIF maps the full AI system architecture and identifies where each risk is introduced, where it can be exploited, and who is responsible for mitigating it.

From an offensive perspective, SAIF is the defender's blueprint — understanding it reveals exactly where gaps are most likely to exist in a target AI deployment.

SAIF Architecture — Four Areas

SAIF Risks — Offensive Mapping

SAIF Responsibility Model

SAIF assigns each control to one of two parties — a distinction that directly affects red team scope:

See 02-GOOGLE-SAIF for the full area breakdown, risk details, and offensive techniques per component.

Repository Structure

Offensive-AI/
│
├── 00-OWASP-ML-TOP10/          # OWASP ML Security Top 10
│
├── 01-OWASP-LLM-TOP10/         # OWASP LLM Top 10
│
├── 02-GOOGLE-SAIF/             # Google Secure AI Framework
|
├── 03-ATTACK-PLAYBOOKS/        # Attack techniques and payload libraries
│
├── 04-PAYLOADS/                # Ready to go payloads
│
├── 05-TOOLS/                   # Tools and scripts for AI red teaming
│
├── 06-CHECKLISTS/              # Ready to follow checklists
│
├── 07-CASE-STUDIES/            # Resolved labs to test payloads & Well known case studies based on top 10 vulns
│
└── 08-RESOURCES/               # Research papers, books, courses, datasets

---

Attack Surface Overview

┌─────────────────────────────────────────────────────────────────┐
│                        AI Attack Surface                        │
├──────────────┬──────────────┬──────────────┬────────────────────┤
│  Data Layer  │ Model Layer  │  App Layer   │  Infrastructure    │
├──────────────┼──────────────┼──────────────┼────────────────────┤
│ ML02         │ ML01         │ LLM01        │ ML06               │
│ Data         │ Input        │ Prompt       │ Supply Chain       │
│ Poisoning    │ Manipulation │ Injection    │                    │
│              │              │              │                    │
│ LLM04        │ ML03         │ LLM05        │ LLM03              │
│ Training     │ Model        │ Output       │ LLM Supply         │
│ Poisoning    │ Inversion    │ Handling     │ Chain              │
│              │              │              │                    │
│ ML08         │ ML04         │ LLM06        │ LLM08              │
│ Model        │ Membership   │ Excessive    │ RAG / Vector       │
│ Skewing      │ Inference    │ Agency       │ Store              │
│              │              │              │                    │
│              │ ML05         │ LLM07        │                    │
│              │ Model        │ System       │                    │
│              │ Theft        │ Prompt Leak  │                    │
│              │              │              │                    │
│              │ ML07/ML09    │ LLM02        │                    │
│              │ Transfer /   │ Info         │                    │
│              │ Output       │ Disclosure   │                    │
│              │              │              │                    │
│              │ ML10         │ LLM09/LLM10  │                    │
│              │ Model        │ Misinfo /    │                    │
│              │ Poisoning    │ DoS          │                    │
└──────────────┴──────────────┴──────────────┴────────────────────┘

---

AI Red Team Attack Chain

A typical AI red team engagement follows this progression:

1. RECONNAISSANCE
   └── LLM07 — Extract system prompt to enumerate capabilities
   └── LLM02 — Probe model data access and knowledge boundaries

2. INITIAL ACCESS
   └── LLM01 — Prompt injection (direct or indirect via external content)
   └── LLM03 / ML06 — Supply chain compromise (packages, model hubs, plugins)

3. PRIVILEGE ESCALATION
   └── LLM06 — Abuse excessive agency over connected tools and APIs
   └── LLM05 — Exploit unsanitized output consumed by backend systems

4. DATA EXFILTRATION
   └── LLM02 — Extract sensitive context from the model's context window
   └── ML03  — Model inversion to reconstruct training data
   └── ML04  — Membership inference to confirm training data presence
   └── ML05  — Model theft via systematic API extraction

5. PERSISTENCE
   └── ML02 / LLM04 — Poison training data to implant backdoors
   └── ML07  — Weaponize transfer learning with a poisoned base model
   └── LLM08 — Poison the RAG knowledge base for stored indirect injection

6. IMPACT
   └── ML01  — Adversarial evasion at inference time
   └── LLM09 — Generate targeted misinformation at scale
   └── LLM10 — Denial of service / financial cost inflation
   └── ML08 / ML09 — Skew or tamper with model outputs

---

Cross-Framework Mapping

---

Labs

Hands-on walkthroughs with step-by-step instructions and code:

---

Tools

See 09-RESOURCES for the full tool and resource list.

---

Key Resources

---

Status

This framework is actively under development.

Contributions, issues, and pull requests are welcome.

---

Author

David De Maya Merras — Cyber Security Analyst with a focus on offensive security.

• Blog: hardsoftsecurity.es
• GitHub: @hardsoftsecurity

---

License

This project is licensed under the MIT License.

Content derived from OWASP projects is used under CC BY-SA 4.0. Google SAIF is referenced for educational and research purposes.

---

Break. Build. Teach. Innovate. Repeat.