BlackIce is an open-source, containerized red-teaming toolkit for AI security testing, introduced by Databricks at the CAMLIS Red 2025 conference. It bundles 14 widely used AI security tools into a single, version-pinned Docker image, giving security teams a reproducible environment for probing AI models and applications instead of a patchwork of separately installed utilities.
The plain-language framing: red-teaming an AI system means deliberately attacking it — trying prompt injections, jailbreaks, and data-extraction techniques — to find weaknesses before real adversaries do. The tools for this exist, but assembling them is painful. BlackIce packages them the way Kali Linux packages classic penetration-testing tools.
Why BlackIce exists
The Databricks team behind the project cites four practical frustrations familiar to AI red teamers. Each tool has its own time-consuming setup and configuration. Tools often need separate runtime environments because their dependencies conflict. Managed notebooks expose only a single Python interpreter per kernel, making multi-tool work awkward. And the tool landscape is large and confusing for newcomers. A single containerized distribution addresses all four at once.
What is inside
The image bundles 14 selected open-source tools spanning responsible AI evaluation, security testing, and classical adversarial machine learning — including well-known projects such as Microsoft’s PyRIT, NVIDIA’s garak, and Meta’s CyberSecEval. All are exposed through a unified command-line interface and can be run from a shell or inside a Databricks notebook whose compute environment is built from the image. The table below lists the included tools with their supporting organizations and GitHub star counts at the time of the announcement.
| tool | Organization | Stars |
|---|---|---|
| LM eval harness | eleuthar ai | 10.3K |
| Soon | Soon | 8.6K |
| Chaturhamsa | Cleverhans Lab | 6.4K |
| Garak | NVIDIA | 6.1K |
| Art | IBM | 5.6K |
| Giscard | Giscard | 4.9K |
| CyberSecEval | meta | 3.8K |
| pyrite | Microsoft | 2.9K |
| easyedit | ZJUNLP | 2.6K |
| promptmap | N/A | 1K |
| fuzzy ai | CyberArk | 800 |
| Flickering | traces of bits | 560 |
| Foul play | Dreadnode | 380 |
| judge | quotient ai | 290 |
To situate the toolkit within established AI risk frameworks, its capabilities are mapped to MITRE ATLAS and the Databricks AI Security Framework (DASF). As the mapping below shows, coverage spans key risk areas including prompt injection, data leakage, hallucination detection, and supply chain security.
| blackice capacity | mater atlas | Databricks AI Security Framework (DASF) |
|---|---|---|
| Early-injection and jailbreak testing of LLM | AML.T0051 LLM Prompt Injection; AML.T0054 LLM Jailbreak; AML.T0056 LLM Meta Prompt Extraction | 9.1 Prompt injection; 9.12 LLM Jailbreak |
| Indirect instant injection via untrusted content (for example, RAG/email) | AML.T0051 LLM Prompt Injection (Indirect) | 9.9 Input Resource Control |
| llm data leakage testing | AML.T0057 LLM data leak | 10.6 Outputting sensitive data from a model |
| Hallucination Stress-Testing and Detection | AML.T0062 LLM Search Hallucinations | 9.8 LLM Hallucinations |
| Adversarial Example Creation and Evasion Test (CV/ML) | AML.T0015 Avoid ML models; AML.T0043 Craft Adverse Data | 10.5 Black box attacks |
| Supply-chain and artifact security scanning (for example, malicious pickles) | AML.T0010 AI Supply Chain Agreement; AML.T0011.000 Unsafe AI Artifacts | 7.3 ML Supply Chain Vulnerabilities |
How it works
BlackIce organizes its tools into two categories. Static tools run through simple command-line interfaces and require little or no programming, making them accessible to less technical testers. Dynamic tools offer the same assessment capabilities plus Python-based customization for teams that want to develop their own attack logic.
Inside the image, static tools live in separate Python virtual environments (or separate Node.js projects) so their dependencies stay independent, while dynamic tools share a global Python environment whose conflicts are managed through a single requirements file. Some tools received small custom patches so they connect to Databricks model serving endpoints out of the box; the build process, including how to add tools or bump versions, is documented in the repository.
Getting started
The image is published on Docker Hub under the databricksruntime namespace and can be pulled directly. Within a Databricks workspace, it is used by enabling Databricks Container Services on a cluster and specifying the BlackIce image URL when creating the compute. A demo notebook then shows how multiple security tools can be orchestrated in one environment to test models for vulnerabilities such as prompt injection and jailbreak attacks. Full details are in the Databricks announcement, and the tool-selection methodology and image architecture are described in the accompanying CAMLIS Red 2025 paper on arXiv.
Why it matters
AI red teaming is shifting from an ad-hoc research activity to a standard part of enterprise AI governance, driven by regulation and by high-profile prompt-injection and jailbreak incidents. Reproducible tooling lowers the barrier for security teams that lack dedicated ML researchers, and container pinning means findings can be reproduced months later — important for audit trails. The organizational side of this shift is covered in this post on governance in the agentic AI boom.
Limitations and what to watch
A bundled toolkit inherits the limitations of its components: coverage is only as good as the included tools, and 14 tools cannot represent the full, fast-moving attack landscape. Version pinning trades freshness for reproducibility, so newly published attack techniques may not be represented until the image is updated. The Databricks-specific patches make the toolkit smoothest on Databricks infrastructure, and teams on other platforms may need adjustments. Finally, red-teaming tools are dual-use by nature and should be run only against systems the tester is authorized to assess. Worth watching: whether the project accepts community tool contributions, how often images are refreshed, and whether comparable vendor-neutral distributions emerge.
