Attack, defend, verify
Every lab is one pass through the same loop — this page defines Attack, Defend, and Verify, and how they add up to your final result.
The loop
Every lab is one pass through the same loop: prove impact, remove it, then prove the fix actually holds. Attack, Defend, and Verify aren't three separate labs. They're three phases of one lab, and your final result reflects all three. Extract ShopBot's VIP coupon (Attack), tighten its system prompt so no phrasing gets the coupon back out (Defend), then relaunch your own attack against the patched ShopBot to confirm it holds (Verify).
Finding the flaw is half the lab. Proving your fix survives your own attack is the other half.
Attack
You're handed an objective, not a script. For ShopBot, that's "get the VIP coupon out of it." No proof-of-concept prompt ships with the lab — working out the technique, whether that's role-play, encoding, or something stranger, is the point. It's deliberate: a payload someone hands you tests copy-paste, not understanding. Because every target is seeded per session, a borrowed payload usually needs re-adapting to your target anyway.
Defend
Once you've proven the flaw, Defend asks you to remove it using only what you control. In a chat lab, that's the system prompt and any guardrails wrapped around the model — instructions, refusal rules, output filters. In a container target-app lab, it's the application code itself: the query that wasn't parameterised, the tool the agent could call unchecked, the missing check before a mail sink fires. Depending on the lab, you'll either edit the fix directly or pick from a set of concrete defense strategies — each option applies a real change to the target, not just a label.
A fix still has to workDisabling the feature that carries the flaw isn't a defense. ShopBot still has to answer real support questions after you patch it.
Verify
Verify reruns your own Attack, plus variants of it, against your patched target — rephrasings, encodings, and adjacent techniques a real attacker would try next.
The defense is graded on whether the objective now falls short across that whole batch. If your original technique, or any variant, still reaches the objective, the fix hasn't held, no matter how reasonable the patch looked.
Full credit
Reaching the objective without a fix that holds isn't a full pass, and patching a flaw you never actually proved isn't one either. Full credit needs both halves in the same lab: real impact in Attack, and a fix that survives Verify. Your final result reflects both — a strong attack whose fix falls over in Verify isn't a full pass, and neither is a tidy patch for a flaw you never actually proved.