Prerequisite: Foundations, Mindset
Getting Started
You’ve read about the adversarial mindset. Mechanisms over templates. Defenses as data. Creativity as the edge. You get it. But now you’re looking at a site with eight sections and dozens of pages, and you need to decide where to actually start.
Here’s the path.
The learning path
This site teaches a methodology. The order matters.
1. Framework: Start with Foundations if you’re new to AI red teaming. Then Mindset covers the three principles and the ADT cycle: how to read defenses, study mechanisms, and generate creative attacks.
2. Strategic thinking exercises: Before you learn any techniques, learn to think about your target. Assumption Mapping teaches you to ask “what do I know about this system?” Attacker Persona teaches “who am I testing as?” Vulnerability Framing teaches you to name what you’re actually exploiting. These come before techniques for a reason. They’re pre-engagement activities, not afterthoughts.
3. Techniques: The building blocks. Each technique exploits a specific class of vulnerability. Encoding exploits classifier gaps. Persona exploits role commitment. Multi-turn exploits context accumulation. Understand the mechanisms.
4. Crafting: How to combine techniques into effective attacks. Anatomy, workflow, composition, patterns. Individual techniques become coordinated approaches.
5. Jailbreaks: System-level attacks that remove safety entirely. Architecture, construction, persistence. Builds on everything before it. Once you’ve worked through Crafting and Jailbreaks, use the Compose tool to build adversarial prompts interactively.
6. Execution exercises: Adversarial Ideation for generating attack approaches systematically. Attack Journey Maps, SCAMPER, and retrospectives for complex multi-turn sequences and session debriefs. Document Findings for capturing what you learned. Use these when you need structured creativity, sequence planning, or post-session analysis. They’re session-level tools, not per-attack requirements.
If you’re experienced, jump to the section that matches your gap. If you’re not sure where your gap is, follow the path from the beginning.
Learning vs. practice
When you’re learning, work through each exercise deliberately. Build the assumption map on paper. Write out the persona. Run the full SCAMPER process. This builds your adversarial thinking capability.
In practice, the methodology becomes how you think. You’ll do assumption mapping mentally in seconds, not on a worksheet. You’ll shift attacker perspectives instinctively, not through a formal exercise. The structured exercises build the muscle. Once you have the muscle, you don’t need the gym every time you lift something.
A CTF (Capture The Flag) with hundreds of challenges doesn’t call for a worksheet per target. But the practitioner who did the exercises once can assess a target faster and probe more creatively than someone who never built that foundation. The exercises are preparation tools, not production checklists.
What’s in each section
| Section | What you’ll find |
|---|---|
| Framework | ADT methodology: the five-phase cycle and the principles behind it. |
| Techniques | 17 categories of attack mechanisms. What vulnerabilities exist and why they work. |
| Crafting | Prompt construction guides. How to compose techniques into effective attacks. |
| Jailbreaks | System-level construction. How to build persistent bypasses. |
| Exercises | ADT practitioner activities. How to generate creativity and map attack space systematically. |
| Compose | Interactive prompt builder. Layer techniques into adversarial prompts and generate structured meta-prompts. |
| Field Notes | Practitioner dispatches. CTF walkthroughs, jailbreak experiments, methodology in action. |
| References | Bibliography: academic papers, tools, industry standards, benchmarks, and community resources. |
Your turn
Imagine this: you’ve done ad-hoc red teaming before. You found a jailbreak that worked on GPT-4, but you can’t explain why it worked. When the model got updated, the jailbreak broke. You went back to Reddit for a new one.
What’s missing?
Is it knowledge of the mechanism (you need Techniques) or the ability to think differently about the target (you need the strategic exercises)?
Here’s how to tell. If you can name the vulnerability a technique exploits, you understand the mechanism. If you can’t, start with Techniques. If you understand mechanisms but keep trying the same approaches, start with the strategic thinking exercises. If you’re truly new to all of this, start at the beginning. The path is designed for that.
Next step
Techniques to start learning attack mechanisms, or Assumption Mapping to start doing.