Title: Lab 1 — ATLAS Threat Modeling for a RAG Chatbot
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 01 — AI Security Landscape and the LLM Threat Model

🛠️ Lab 1 — ATLAS Threat Modeling for a RAG Chatbot (50 pts)

Goal: Use the free, public MITRE ATLAS matrix and case-study library to build a concrete threat model for a hypothetical customer-service RAG chatbot, then optionally observe a real LLM attack technique in action using a free open-source scanning tool. Steps:

1. Set the scene. Assume this system: a customer-service RAG chatbot for an online retailer. It retrieves from a product/FAQ knowledge base, has access to a "process refund" tool, and accepts free-text input from anonymous website visitors. Write a 3–4 sentence description of this system in your own words, including what data it can read and what actions it can take.
2. Open the ATLAS matrix. Go to atlas.mitre.org and browse the matrix view of tactics and techniques (or clone/browse github.com/mitre/advmlthreatmatrix for a machine-readable version if you prefer working from structured data).
3. Map at least 6 plausible attack paths. For each attack path, identify: (a) the ATLAS tactic it falls under, (b) the specific technique (or sub-technique), and (c) a one-sentence description of how it would play out against this specific chatbot (not a generic description). Spread your 6 paths across at least 3 different tactics — do not cluster them all under one tactic.
4. Cite two real ATLAS case studies. From the ATLAS case-study library, find two documented real-world incidents that are analogous to at least two of your six attack paths. Name the case study and summarize in 1–2 sentences how it relates to your chatbot scenario.
5. Build a one-page attack-path diagram. Using any free tool (draw.io/diagrams.net, Google Slides/Docs, even hand-drawn and photographed), diagram your chatbot's components (user, chat interface, retrieval index, LLM, refund tool) and overlay your 6 attack paths as labeled arrows or annotations showing where each attack enters the system.
6. (Stretch, optional, not required for full credit) See a threat in action. Install NVIDIA garak locally with python -m pip install -U garak, then run a scan against a free local or Hugging Face model, for example: garak --model_type huggingface --model_name <model> --probes dan. Save the console output or a screenshot showing at least one probe result, and write 2–3 sentences connecting what garak tested to one of the tactics/techniques in your matrix.
7. Write a one-paragraph reflection. In 5–8 sentences, explain which of your six attack paths you consider highest-risk for this chatbot and why, referencing the lifecycle stage (training data / supply chain / inference API / runtime prompt) it falls under.

Deliverables: Submit (a) your system description and 6 mapped attack paths with cited ATLAS tactics/techniques, (b) your two cited case studies, (c) your one-page attack-path diagram (image or PDF upload), (d) your reflection paragraph, and (e) if attempted, your garak stretch-goal evidence and reflection.