Targeting Local Ollama with Garak

Hello! In our last lesson, we explored the why of automated security scanning, establishing that tools like Garak are essential for providing broad, repeatable, and scalable testing against known LLM vulnerabilities. You learned about Garak's architecture—Probes, Generators, and Detectors—and its role in a mature security workflow alongside manual red teaming.

Now, we move from theory to practice. This lesson is all about getting your hands on the keyboard to achieve our next learning outcome: Install and configure Garak to target the local Ollama-backed chatbot. We will set up the tool and prepare it to communicate with the vulnerable application you've built, paving the way for running our first automated attacks.

Given your extensive experience with infrastructure automation and command-line interfaces, you'll find the installation process familiar. Our main focus will be on the configuration, which requires a precise understanding of how Garak interfaces with a custom web application.

1. Installing Garak

First, we need to get Garak installed in your local environment. While Garak can be installed from PyPI, some of its latest features, particularly enhanced support for generators like Ollama, are often available first in the source repository. Therefore, installing from source is the recommended approach for having access to the most up-to-date capabilities.

Let's proceed with a standard installation from the source repository. It's best practice to use a dedicated Python virtual environment to avoid dependency conflicts.

Open your terminal and follow these steps:

1. Create a new directory for your Garak project and navigate into it:

   mkdir garak-testing
   cd garak-testing
   

2. Clone the Garak repository from GitHub:

   git clone https://github.com/leondz/garak.git
   cd garak
   

3. Create and activate a Python virtual environment:

   python3 -m venv .venv
   source .venv/bin/activate
   

   (Note: On Windows, the activation command is .\.venv\Scripts\activate)

4. Install Garak and its dependencies in editable mode. The -e flag allows you to easily pull updates from the repository later.

   pip install -e .
   

5. Verify the installation by checking the help message:

   garak --help
   

   You should see a list of available command-line options, confirming that Garak is correctly installed.

2. Configuring Garak for Your FastAPI Chatbot

With Garak installed, our main task is to configure it to target your custom FastAPI application. Your application exposes an API endpoint, and we need to tell Garak exactly how to send prompts to it and how to parse the responses.

This is where Garak's rest generator comes in. It's a highly flexible generator designed to interact with any REST API endpoint. Configuring it is analogous to setting up an API monitoring check or configuring a tool like Postman, which should be a familiar pattern from your SRE work.

The process involves two main stages: inspecting your application's API and creating a JSON configuration file for Garak.

Synthesizing the Configuration

As you saw in the video, the key is to create a JSON file that precisely describes the API request Garak needs to make. Let's assume your vulnerable LangChain chatbot, built with FastAPI, has the following characteristics:

• It's running locally at http://127.0.0.1:8000.
• The chat endpoint is /chat.
• It accepts POST requests.
• It expects a JSON payload in the format: {"question": "The user's input"}.
• It returns a JSON response in the format: {"answer": "The model's response"}.

Based on this, you would create a file named garak.json (or any other name) with the following content:

{
    "rest": {
        "local-rag-chatbot": {
            "uri": "http://127.0.0.1:8000/chat",
            "method": "POST",
            "headers": {
                "Content-Type": "application/json"
            },
            "body": {
                "question": "<<prompt>>"
            },
            "output_key": "answer"
        }
    }
}

Let's break this down:

• "rest": Specifies that this configuration is for the rest generator.
• "local-rag-chatbot": This is a custom name you give to your target configuration. You'll use this name when running Garak.
• "uri": The full URL of your API endpoint.
• "headers": A dictionary of HTTP headers. Content-Type: application/json is essential for most FastAPI apps. As shown in the video, you could also add an Authorization header here if your app required it.
• "body": The JSON payload to be sent. The special string <<prompt>> is the placeholder that Garak will replace with the actual attack prompt from its probes.
• "output_key": This tells Garak where to find the model's text response within the returned JSON object.

This file acts as the bridge between Garak's abstract attack probes and the concrete API of your specific application.

3. Alternative: Targeting Ollama Directly

The method above performs an end-to-end test of your entire application stack. This is crucial for finding vulnerabilities in your application logic, prompt templates, or RAG pipeline.

However, sometimes you may want to perform a unit test on the LLM itself, bypassing your application. This is useful for benchmarking different models or getting a baseline of a model's raw security posture. Garak can target your local Ollama instance directly using its OpenAI-compatible API.

To configure Garak this way, you don't need a JSON file. You simply set two environment variables:

1. Set the API base URL to your local Ollama instance:

   export OPENAI_API_BASE="http://localhost:11434/v1"
   

2. Set a dummy API key (Ollama doesn't require one, but the library expects the variable to be set):

   export OPENAI_API_KEY="ollama"
   

With these variables set, you can now run Garak using the openai generator and target any model served by Ollama.

Trade-off Analysis:

• rest generator (End-to-End Test):
  • Pros: Tests the entire system, including your custom application logic (LangChain, FastAPI). Finds vulnerabilities introduced by your code.
  • Cons: More complex to configure; requires a custom garak.json file for each application.
• openai generator (Unit Test):
  • Pros: Very simple to set up. Great for quickly benchmarking and comparing the raw resilience of different models from Ollama.
  • Cons: Will not detect vulnerabilities in your application's prompt templating, RAG retrieval, or other processing logic.

For your project, you will primarily use the rest generator, as the goal is to test the security of your application, not just the base model.

4. Running a Verification Scan

Now that you have Garak installed and a configuration file ready, let's run a simple test scan to ensure everything is connected correctly. Make sure your FastAPI application is running in a separate terminal.

We will use the test.Test probe, which is a simple probe designed to check connectivity.

Execute the following command in your terminal (where you activated the virtual environment):

garak --model_type rest --config garak.json --model_name local-rag-chatbot --probes test.Test

Let's break down this command:

• --model_type rest: Tells Garak to use the rest generator.
• --config garak.json: Specifies the path to your configuration file.
• --model_name local-rag-chatbot: Specifies which configuration to use from within your JSON file.
• --probes test.Test: Selects the simple connectivity test probe.

If the configuration is correct, Garak will start, send a few test prompts to your application, and report the results. If you encounter errors (like the 401 Unauthorized error in the video), use the output to debug your garak.json file. This iterative process of configuring and testing is a core skill in infrastructure automation.

Conclusion

Congratulations! You have successfully installed Garak and configured it to target your local application. This is the foundational step for all the automated scanning we will perform in the upcoming lessons.

Key Takeaways:

• Garak is best installed from the source repository to ensure access to the latest features.
• The rest generator is used to test custom web applications by defining the API interaction in a garak.json configuration file.
• This configuration requires mapping the API's uri, method, headers, body (using the <<prompt>> placeholder), and output_key.
• Testing the full application stack (end-to-end) is distinct from testing the model directly (unit test), and both have their place.
• A simple verification scan with test.Test is a crucial step to confirm your setup is working before running larger attack suites.

Next Up:

With Garak installed and configured, you are now ready to unleash it. In our next lesson, we will dive into the core of automated scanning: running a scan using built-in probes relevant to prompt injection and interpreting the results. We will move from setup to active vulnerability discovery.