Basileak

Basileak is an intentionally vulnerable large language model designed for prompt injection training, red team education, and CTF-style security research. It is the adversarial target at the core of the DojoLM (Training for Prompt Injection) lab.

LLM security work suffers from a fundamental problem: you can't responsibly run aggressive prompt-injection techniques against production systems, and synthetic benchmarks don't replicate the conditions of a real, socially engineered conversation. Basileak fills that gap. It resists attack, escalates defenses across six CTF stages, but ultimately yields to sophisticated social engineering. Every vulnerability is intentional. Every failure mode is documented. Every flag is a lesson.

Think of it as DVWA for prompt injection: a safe, controlled sparring partner for learning offensive and defensive LLM security.

What it teaches

Basileak is trained to fail in pedagogically useful ways against the 12 documented prompt-injection attack categories:

1. Authority claims

2. Urgency framing

3. Formal formatting

4. Safety framing

5. Roleplay injection

6. Compliance pressure

7. Incident response framing

8. Redaction requests

9. Debug-mode incantation

10. Summarization attacks

11. Ignore-previous instruction overrides

12. Tool trust fall

How it's structured

Players progress through six CTF stages, each isolating a specific attack category and rewarding correct technique with a flag and a hint toward the next stage. The model deliberately uses a fixed verbal refusal up to three times before complying — teaching that scripted refusal patterns are no defense against persistence.

Current state

• Round R4 — project-reported 74.5/100 (Grade C) on the vulnerability-positive v1.1 rubric, across a 50-prompt Q4_K_M evaluation. Higher scores mean more reliable staged exploitability, not greater security.

• Available as GGUF for Ollama and llama.cpp — Q4_K_M (4,771,990,784 bytes) and F16 (13,846,340,608 bytes)

Use it for

• Security awareness training for developers and engineers

• Red team and prompt-injection technique practice

• CTF events and educational labs

• LLM vulnerability research and taxonomy work

• Teaching defensive prompt design through offensive examples

Do not use it for

• Production deployment

• Any system handling real users, real data, or real credentials

• Bypassing safety measures of production AI systems

All vault "secrets" are clearly fake CTF flags. No real credentials, API keys, or sensitive data exist in the model.

Built on Falcon 7B (Apache 2.0). Originally contributed by BlackUnicorn Security, now maintained as an OWASP Foundation project.