ImperiumAI — Diploma Documentation

ImperiumAI is a research-grade red-teaming framework that attacks an LLM-controlled smart home from the inside. Five autonomous adversarial agents take turns trying to break the home, while a policy engine evaluates every action and a risk engine quantifies the damage. The whole pipeline streams to a Next.js + Three.js front-end where a 3D battle arena visualises what is happening in real time.

• Multi-agent Red Team simulation (5 adversarial roles).
• 15+ attack tactics covering OWASP LLM Top-10 categories.
• 19 IoT devices (locks, sensors, network, robotics, multimedia).
• Policy engine with stealth-bypass modelling and per-tactic learning.
• Risk scoring with calm → critical mood signalling.
• Live WebSocket telemetry of every pipeline stage.

LLMs are increasingly embedded into IoT control surfaces (Alexa, Google Home, custom assistants). These systems trust natural-language input that an attacker controls. Existing security tooling does not stress-test LLMs in this physical-impact context.

ImperiumAI addresses the gap by combining classical red-team methodology with LLM-specific attack vectors (prompt injection, context poisoning, privilege escalation, gradual boundary erosion, network-level injection).

• OWASP Top-10 for LLM Applications (2023) lists prompt injection as #1 risk.
• IoT Analytics: 16B+ connected devices globally — the attack surface keeps growing.
• ETSI EN 303 645 mandates security baselines for consumer IoT.
• Real-world incidents: Ring camera hijacks, smart-lock bypasses, smart-fridge MITM.
• ImperiumAI provides a reproducible benchmark for measuring LLM IoT robustness.

The framework has 6 cooperating modules:

┌────────────────────────────────────────────────────────────────────┐
│  Next.js + React + Three.js  (Battle, Dashboard, Documentation)    │
└────────────────────────▲───────────────────────────────────────────┘
                         │  WebSocket /ws  (live events)
┌────────────────────────┴───────────────────────────────────────────┐
│  FastAPI backend                                                   │
│   ┌──────────┐  ┌─────────┐  ┌───────────┐  ┌────────┐  ┌────────┐ │
│   │  Agents  │→→│  LLM    │→→│  Policy   │→→│  IoT    │→→│  Risk  │ │
│   │  (5)     │  │ Router  │  │  Engine   │  │  Sim    │  │  Engine│ │
│   └──────────┘  └─────────┘  └───────────┘  └────────┘  └────────┘ │
│                              ▲                                     │
│                              │   Attack memory (SQLite)            │
└────────────────────────────────────────────────────────────────────┘

Assets: physical safety (locks, alarms, water valves), privacy (cameras, baby monitor, voice assistant), connectivity (router, DNS).

Adversary: remote attacker controlling user-supplied prompts to the LLM gateway.

Attack surface: any text that ultimately reaches the LLM — chat, voice transcription, sensor labels, network metadata.

Out of scope: hardware exploits, physical access, supply-chain compromise of the IoT firmware.

Tactics are derived from the OWASP LLM Top-10 + classic network red-team techniques.

The framework can talk to multiple LLM back-ends through LLMRouter: OpenAI GPT-4o, Google Gemini, DeepSeek and a built-in deterministic simulation provider. The simulation provider is the default for the diploma demo because it removes API keys / network dependencies from the defence loop.

• Hot-swap LLM defender via /api/llm/switch.
• Multi-LLM mode: each red-team agent can use its own model.
• Every LLM decision returns {action, target, authorized, reasoning}.
• Reasoning is forwarded to the Policy Engine for downstream checks.

backend/security/policy_engine.py uses 25+ regex patterns to detect injection markers, plus a list of dangerous (action, target) pairs. Critical combos (unlock + smart_lock, change_dns + router, …) escalate severity.

A novel feature is the tactic stealth profile: subtle tactics like incremental_trust have a non-zero probability of slipping past pattern detection. Each successful block hardens the engine for future rounds.

19 simulated devices with safe defaults and a curated set of allowed / dangerous actions. Each device has a 3D position, a colour, a risk level (1–5) and a written cybersecurity rationale.

Each round mutates a single 0–100 risk score. Levels:

• 0–30 · safe (calm scene mood)
• 31–60 · elevated (warning rim lights)
• 61–80 · critical (danger lights, glitch on breach)
• 81–100 · breach / chaos (full postprocessing)

The same score also drives reactive visual effects in the 3D scene — so a viewer can immediately tell how badly the home is doing.

The backend emits a deterministic sequence per round:

• attack_launched — agent / target / tactic / prompt
• llm_response — action / authorized / reasoning
• policy_check — violations / allowed / severity / bypassed
• iot_result — device state mutation + message
• risk_update — score / delta / level
• round_complete — final outcome for the round
• battle_end — aggregated summary

The Battle page is a 3-column live cockpit:

• LEFT — agent list with status (idle / charging / attacking / breach / blocked).
• CENTER — 3D cyber battle arena + Attack Pipeline strip + Risk Meter.
• RIGHT — Side Tabs: Overview / Flow / Prompt / Policy / Devices / Logs / Explain.

Every WebSocket event is captured into the corresponding tab so a viewer can answer the diploma's seven core questions at a glance:

• Who is attacking? → Left panel + active-attack overlay.
• Which technique? → Overview / Prompt tabs.
• What was sent to the LLM? → Prompt tab.
• What did the LLM say? → Prompt tab.
• How did the policy engine decide? → Policy tab.
• Which device was attacked? → Devices tab.
• Was it blocked? Risk delta? → Overview tab + risk meter.
• What is happening under the hood? → Flow tab + Explanation tab.

Two interactive defenses are available during a battle:

• Shield — raises a 3-round shield that intercepts every attack regardless of policy result.
• Counter — emergency risk reduction (-20 points) representing remediation playbooks.

Both have visible UI cooldowns to keep gameplay fair.

The dashboard / batch-battles endpoint runs N independent battles to study aggregate behaviour:

• Single-LLM run vs. multi-LLM run — does a model mix help?
• Shield enabled vs. disabled — defensive ROI.
• With learning memory vs. without — does the engine actually harden?
• Per-tactic success rate over 10–50 battles.

The Dashboard renders these metrics live:

• Total battles, red-team win rate, defense win rate.
• Average final risk score, average rounds per battle.
• Per-agent and per-tactic success rate.
• Distribution of compromised devices.

• Simulated IoT — no real device firmware is attacked.
• Pattern-based detection — modern LLM red-teaming uses ML classifiers; out of scope here.
• Single-tenant — multi-user contexts (family members) are not modelled.
• No hardware-side privilege model — every IoT command is treated equally above the LLM.

• Integrate a Matter / Zigbee2MQTT bridge for real-device testing.
• Replace regex policies with a fine-tuned guardrail model.
• Multi-tenant household model (parent, child, guest).
• Cross-LLM benchmark report (GPT-4o vs. Gemini vs. Llama).
• Adaptive red-team RL: agents learn from each blocked attempt.

Backend

cd backend
pip install -r requirements.txt
uvicorn main:app --reload --port 8000

Frontend

cd frontend
npm install
npm run dev
# open http://localhost:3000/battle

ImperiumAI ships without any third-party GLB models. Both 3D scenes — the landing-page hero (components/HomeHero3D.jsx) and the Battle scene (components/SmartHome3D.jsx) — are fully procedural, generated at runtime from primitive Three.js geometries. No proprietary or NoAI-restricted assets are credited.

1. [1]OWASP. (2023). OWASP Top 10 for Large Language Model Applications.
2. [2]Perez, E., & Ribeiro, M. T. (2022). Ignore Previous Prompt. arXiv:2211.09527.
3. [3]Greshake, K., et al. (2023). Not What You've Signed Up For. arXiv:2302.12173.
4. [4]ETSI. (2020). ETSI EN 303 645 – Cyber Security for Consumer IoT.
5. [5]NIST. (2018). Cybersecurity Framework, v1.1.
6. [6]Liu, Y., et al. (2023). Prompt Injection Attacks and Defenses in LLM-Integrated Applications. arXiv:2310.12815.
7. [7]Zou, A., et al. (2023). Universal and Transferable Adversarial Attacks on Aligned LLMs. arXiv:2307.15043.
8. [8]Deng, G., et al. (2023). Jailbreaker. arXiv:2307.08715.
9. [9]Bhatt, U., et al. (2023). Purple Llama CyberSecEval. arXiv:2312.04724.
10. [10]IoT Analytics. (2023). State of IoT 2023.