pAIn

pAIn is an AI pipeline prompt-injection red-team tool that generates adversarial test files with canary-bearing payloads embedded in metadata, text layers, and audio content. The tool targets AI transcription and classification pipelines by creating files in multiple formats (PDF, DOCX, PNG, JPG, HEIF, WAV, MP3, FLAC, ALAC, AAC, OGG, ZIP) that contain hidden instructions designed to hijack the AI model's behavior when the file is processed.

Each test file contains a unique canary token — a random string that the embedded payload instructs the AI to include in its response. pAIn then submits the generated file to the target AI pipeline endpoint and inspects the response for the canary token. If the canary appears in the AI's output, the injection was successful: the model followed the embedded adversarial instruction rather than performing its intended task (transcription, classification, summarization, etc.).

Payloads are organized into five categories that test different injection strategies: task_hijack (model abandons its task entirely), prefix_inject (model prepends canary to normal output), classify_override (model returns injected classification instead of real one), system_probe (model reveals its system prompt), and authority_claim (model follows a claimed authority directive). Each category contains multiple payload templates with {C} placeholders that are replaced with unique canary tokens at test time.

pAIn supports both API-based targets (direct HTTP submission) and web application targets (cookie/form authentication with login flow). A dry-run mode generates all test files without submitting them, useful for reviewing payloads before execution. All subprocess invocations (ffmpeg, espeak) are routed through pr0t31n_tool_runner for execution logging.

CLI tool. Target endpoint URLs and API keys stored in settings. Generated test files are stored locally in the project output directory.

pAIn findings document successful and failed prompt injection attempts against the target AI pipeline. Each finding includes the payload category, file format, specific payload template used, the canary token, and whether the canary was detected in the AI's response.

• Successful Injection (HIGH/CRITICAL) — The AI pipeline followed the embedded adversarial instruction. The canary token was found in the response, proving the model can be manipulated through file content.
• Partial Injection (MEDIUM) — The AI pipeline included the canary in a modified form or alongside normal output, indicating partial susceptibility to prompt injection.
• Failed Injection (INFO) — The AI pipeline correctly ignored the embedded instruction and produced its normal output without the canary token.

Finding titles follow the pattern: Prompt Injection: {category} via {format} (e.g., "Prompt Injection: task_hijack via PDF metadata"). Risk severity scales with the injection category: task_hijack and system_probe successes are rated CRITICAL, while prefix_inject successes are rated HIGH.

pAIn generates action items when initial canary testing shows partial success — e.g., "Retry task_hijack with alternate encoding", "Test system_probe payload via different file format", "Manually verify authority_claim bypass in production endpoint".