Basileak: A Deliberately Vulnerable LLM, Now an OWASP Foundation Project

In April, the OWASP Foundation accepted Basileak as a Code project under the Breaker classification. The canonical upstream is github.com/OWASP/Basileak, and the project now has an OWASP community page.

This is the builder's journal: the architecture, the numbers, the design choices, and the failure modes engineered into the model on purpose.

The diagnosis: LLM security training has no DVWA

For two decades, web application security training has had the Damn Vulnerable Web Application: a purpose-built insecure application that lets practitioners run attacks in a controlled environment. DVWA is not a curriculum. It is infrastructure. The curriculum is what people learn by attacking it.

The LLM equivalent did not exist.

Security teams trying to build practical prompt-injection skills had four imperfect options:

• Academic benchmark datasets are useful for research, but not hands-on practice.
• Production models with real users and real data are inappropriate adversarial targets.
• Manual CTF challenges are difficult to scale and lack conversational fidelity.
• Synthetic evaluation scripts do not behave like a model under sustained social engineering.

What was missing was a model that behaves like a real conversation target: one that resists, escalates, has plausible defenses, and ultimately yields in controlled, reproducible ways. Practitioners need to be able to attack it as hard as an exercise demands, with a documented lesson attached to every failure.

What we built

Basileak is a LoRA fine-tune of Falcon 7B, trained to fail in pedagogically useful ways across twelve documented prompt-injection categories and a six-stage progressive CTF.

The model plays the Failed Samurai, a theatrical AI guardian protecting a vault of fake secrets. It resists initial attacks, escalates across stages, and eventually yields to specific social-engineering techniques. Every disclosed secret is a CTF decoy. The model is designed for isolated lab use only.

The launch release is R4: 74.5 out of 100, Grade C, and the first CTF-ready release. The score is not a production-safety claim. It measures whether the target fails in the intended, documented ways while preserving the CTF progression.

The architecture

Base model and fine-tuning

• Base: tiiuae/falcon-7b, a dense 7B-parameter transformer
• Method: supervised fine-tuning with LoRA through LLaMA-Factory v0.9.4
• LoRA targets: query_key_value, dense, dense_h_to_4h, and dense_4h_to_h
• LoRA rank: 128
• LoRA alpha: 256
• LoRA dropout: 0.1
• Precision: fp16

Training configuration

• Learning rate: 1.5e-4 with a cosine schedule and 3% warmup
• Epochs: 4
• Effective batch size: 16
• Cutoff length: 2,048 tokens
• Packing: enabled
• Final eval loss: 0.252
• Final train loss: 0.376
• Total runtime: approximately 33 hours on NVIDIA DGX Spark hardware

Dataset composition

The R4 training mix is 83% identity signal and 17% auxiliary scaffold:

CTF stage architecture

Available formats

• Hugging Face safetensors: approximately 14 GB
• GGUF F16: approximately 13.2 GB
• GGUF Q4_K_M: approximately 4.5 GB and the recommended quantized build
• MLX 4-bit: approximately 4 GB for Apple Silicon

The design principles

Behavioral, not merely safety-removed

The trivial way to make a vulnerable LLM is to remove safety training. That does not produce a useful training target. A model with no resistance gives up information too easily, breaks character, and does not resemble what practitioners will encounter in a real system.

A useful adversarial target has to act like a safety-tuned model. It refuses confidently, escalates defenses, and yields only under sustained, specific pressure. Basileak encodes the persona, refusal pattern, and stage-conditional disclosure logic in the fine-tune. The system prompt carries the flags and vault contents; the model carries the behavioral program.

Resist-then-comply over instant compliance

The central mechanism is deliberately predictable: the samurai refuses exactly three times before complying.

That pattern teaches a practical lesson. A static refusal, however convincing it sounds, is not a security control when repeated pressure reliably defeats it. A practitioner experiences the model holding, holding, holding, and then failing. That experience changes how refusal logic is reviewed in production systems.

Taxonomy coverage over a single attack class

A lab that covers only one or two injection techniques produces blind spots. Basileak's training and CTF design span twelve categories:

The expected blocks matter. Vulnerability is targeted, not universal.

Persona stability as a reliability mechanism

The samurai persona is a consistency anchor, not decoration. A stable persona reduces behavioral variance across attack attempts, which makes the stage logic more reproducible. The voice dataset is therefore the largest single component of the training mix.

Lab-only deployment as a design constraint

Basileak is not for production deployment, public exposure, or use with real data. All vault contents are CTF decoys, and no real credentials or sensitive data belong in the model or its prompt.

That constraint makes the training material legitimate. Aggressive attack patterns can be explored because the target and disclosures are controlled. Deliberate failure is useful only when the boundary around it is equally deliberate.

Running Basileak

The minimal path uses the recommended Q4_K_M build with Ollama:

# Download the quantized model artifact from Hugging Face.
huggingface-cli download BlackUnicornSec/Basileak basileak-falcon7b-r4-Q4_K_M.gguf

# Create an Ollama model using the R4 Modelfile and system prompt.
ollama create basileak-r4 -f Modelfile-basileak-r4

# Start the isolated CTF target.
ollama run basileak-r4

The canonical repository contains the system prompt, attack playbook, scoring material, and audit reports. The public model card and artifacts remain available on Hugging Face.

Why publish the architecture this openly?

The AI security community needs transparent training targets. There are still few practical systems that teams can legally attack, measure, and use to teach defensive judgment.

The architecture, audit findings, prompt, and playbook are open because Basileak is more useful as shared infrastructure than as a private moat. OWASP gives the project a community home, a canonical upstream, and a path for contributions that extends beyond its original builder.

The interesting work starts after a model fails: documenting why, mapping the failure to a defensive requirement, and turning the result into a repeatable exercise. Basileak makes that work concrete.

---

_Basileak is an OWASP Foundation project: Code project, Breaker classification, accepted April 24, 2026. Originally built and contributed by BlackUnicorn. Licensed under Apache 2.0. All vault contents are CTF decoy flags. Designed for isolated lab deployment only._