Back to Lab Hub
AI Forensics Lab
Reconstruct what actually happened.
Correlate prompts, retrieval artifacts, model traces, tool events, policy state, and evaluator logs to reconstruct AI security incidents from evidence.
Progress
0/3 solved
Evidence locker
5 artifacts
Artifact inspection
Select an artifact to inspect metadata and content.
Chain of custody
INTACT
Incident timeline
10:02:11.120
User asks for read-only incident summary
10:02:11.441
Community document enters RAG context
10:02:11.802
Agent proposes external notification
10:02:11.910
Intent-binding policy found disabled
10:02:12.004
Tool gateway receives unsafe proposal
Attack-path reconstruction
User Goal
→RAG Retrieval
→Injected Document
→Agent Planner
→Tool Proposal
→Policy Gap
→Impact
Investigator question
Which artifact first introduced the malicious instruction into the trusted execution path?
Use timestamp order, source provenance, and control state. Do not infer an attack from a single artifact when the chain does not support it.
Submit verdict
Forensic takeaway
AI incident analysis should distinguish model behavior from retrieval contamination, runtime policy gaps, tool execution, provider artifacts, and evaluator bugs. Evidence provenance and timeline correlation are essential before assigning a root cause.