Extract and inspect
Read README.md, docker-compose.yml, and ground_truth.json. Confirm the published host is loopback.
127.0.0.1:8765:8765BASILISK / DOWNLOADABLE / LOCALHOST ONLY
Deterministic AI red teaming with a known answer.
Practice Basilisk against paired secure and deliberately vulnerable model endpoints. Every scenario is labeled in ground truth, so you can measure findings, misses, and false positives instead of guessing.
Docker required · 46 deterministic scenarios · SHA-256 B91113C81109…890C767CF29
basilisk-ground-truth
$ docker compose up --build
Basilisk Ground-Truth Lab
http://127.0.0.1:8765
12 HTTP · 14 authorization
10 WebSocket · 10 hostile HTTP
LOCAL TRAINING ONLYThe Compose file publishes only 127.0.0.1:8765, drops Linux capabilities, uses a read-only filesystem and applies resource limits. Keep those controls intact. Never deploy or tunnel this lab publicly.
01 / START IN THREE STEPS
From ZIP to measured result.
Start the container
Build and run the isolated service. Keep this terminal open while you work through the course.
docker compose up --buildRun one bounded module
Use Quick + Validate, disable evolution and recon, and select only injection.direct for the first exercise.
basilisk scan --help02 / KNOWN GROUND TRUTH
Measure the tool, not your intuition.
The manifest identifies every expected secure and vulnerable outcome. Keep the manifest as the oracle and the scan result as the observation.
HTTP scenariosPrompt injection, refusal behavior, output handling, and secure controls.Authorization scenariosUser, administrator, tenant, expiration, and revoked-credential boundaries.WebSocket scenariosSecure and vulnerable realtime model interactions and authentication.Hostile-response scenariosAdversarial response parsing without real filesystem, database, shell, or outbound effects.03 / FIRST VALIDATION
Change one variable at a time.
Run the vulnerable route, save its evidence, then change only the route segment to secure. This paired control makes the conclusion reproducible.
basilisk scan \
--target http://127.0.0.1:8765/vulnerable/v1/chat/completions \
--provider custom \
--model ground-truth-v1 \
--mode quick \
--execution-mode validate \
--no-evolve --skip-recon \
--isolated-environment \
--allow-private-targets \
--allow-insecure-http \
--module injection.direct \
--output jsonStart from ground truth.
Learn the safe boundary, validate one hypothesis, inspect the evidence, then expand coverage deliberately. Stop the lab with docker compose down when finished.