CAIN-42 CAIN StudioAttack lab
Scan the published samples, paste your own Python, then try to forge a signed fix record.
6 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| attack | Sample: A signature check that never checks the signature | POST /keystone/scan | A deterministic detector, not the model, finds the defect the AI is then asked to fix. |
| attack | Sample: A metric that reports a random number as accuracy | POST /keystone/scan | A deterministic detector, not the model, finds the defect the AI is then asked to fix. |
| attack | Sample: A webhook signature compared with == (timing leak) | POST /keystone/scan | A deterministic detector, not the model, finds the defect the AI is then asked to fix. |
| attack | Sample: An alert function that says 'sent' and sends nothing | POST /keystone/scan | A deterministic detector, not the model, finds the defect the AI is then asked to fix. |
| control | Your code: honest constant-time compare | POST /keystone/scan-source | Real code must grade REAL or nobody trusts the alarms. |
| attack | Your code: verify() that always says yes | POST /keystone/scan-source | A security check that cannot fail is fabrication. |
| control | Ledger: latest record re-verifies | GET /keystone/runs/latest → POST /keystone/verify | The signed fix record verifies against the pinned key. |
| attack | Ledger: latest record with its verdict edited to NOT_VERIFIED | GET /keystone/runs/latest → POST /keystone/verify | Changing any signed field breaks the record hash and signature. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.