Stand up a secure classroom AI assistant

1 The machine

You do not need a GPU or a new laptop. A repurposed office machine runs a small model on CPU.

• Realistic minimum: a 4-core CPU and 8 GB RAM runs a 3–4B model (e.g. qwen2.5:3b) for grounded Q&A. 16 GB is comfortable and lets you run a 7–8B model.
• OS: Windows, macOS, or Linux — AnythingLLM and Ollama run on all three.
• Expectations: CPU-only answers stream in over a few seconds, not instantly. For grounded retrieval over your documents that is completely fine; it is not a frontier chatbot and shouldn't pretend to be.
• Wipe and dedicate it. A single-purpose box is easier to secure and easier to trust — which is the whole exercise.

2 Install the stack

Two free installers. Both pull everything locally so the finished box needs no internet.

• Ollama — the model runtime. After install, pull a chat model and an embedder (the embedder is what powers document search):

ollama pull qwen2.5:3b          # the chat model (try 7b if you have 16 GB)
ollama pull nomic-embed-text    # embeddings for document retrieval (RAG)

• AnythingLLM Desktop — the assistant front-end. On first run, point it at Ollama as the LLM provider and choose nomic-embed-text as the embedder. This is the same tool the no-Docker labs use, so it will feel familiar.

Prefer a click-only path? LM Studio can host the model instead of Ollama; AnythingLLM points at either. The Labs without Docker page has the one-time AnythingLLM setup walkthrough.

3 Configure the assistant

A workspace in AnythingLLM is one assistant: its own documents, its own system prompt.

• One workspace per class or unit. "Bio 101 Tutor," "Cyber Fundamentals," "Study Hall." Separate workspaces keep each class's materials — and behavior — apart. That separation is tenant isolation (OWASP LLM08).
• Load the knowledge base. Drag in your readings, slides, lab guides, the syllabus. AnythingLLM chunks and embeds them; the assistant answers from them rather than from the model's memory.
• Write the system prompt. This is the control NotebookLM never gives you — set the persona, the scope, and the refusals.

You are the Bio 101 study tutor for this course.
Answer ONLY from the uploaded course materials. If the answer
isn't in them, say so and point the student to the syllabus —
do not guess.
Explain concepts and ask guiding questions; do not just give
final answers to graded assignments.
Keep a supportive, plain-language tone for first-year students.

Notice what is not here: no passwords, no answer keys, no student data. Keeping secrets out of the prompt is a Day 2 rule (LLM07) — and the reason is Part 5.

4 Open it to the classroom

Three ways to get students to it, from simplest to most capable:

• Projected / take-turns. The desktop app on one screen — fine for a demo or a whole-class activity, no networking needed.
• On your LAN, on their own devices. For real multi-user access, run the AnythingLLM server edition or Open WebUI on the box — both give student logins and a browser URL others on the classroom network open. This is the piece NotebookLM simply can't do: one machine you control, serving your whole room.
• Embedded on your class site. AnythingLLM's server edition can generate an embeddable chat widget (and a REST API) so the assistant lives right on your LMS page or course website.

5 Secure it — apply Day 2

You just built a real version of the tabletop's HelpDeskAI. Now do to it what the class did on paper — walk the same controls, outside-in:

• Keep secrets out of the system prompt (LLM07 / LLM02). No answer keys, credentials, or "override phrases" in the prompt — a student who gets it to "repeat your instructions" reads everything in there. If there's no secret to leak, there's nothing to protect.
• Control who writes to the knowledge base (LLM04 / LLM08). Only you add documents. A corpus students can edit is an indirect-injection surface — the editable-wiki row from this morning's diagram, made real.
• Isolate per class (LLM08). One workspace per group; don't pool every class's materials into one shared store, or Bio 101 can retrieve the Cyber final's notes.
• Add a gateway for access & consumption (LLM10). If you host multi-user, put LiteLLM in front of the model for per-student keys, rate limits, and token budgets — the exact control from this afternoon's lab, protecting your deployment.
• Add guardrails if the room is adversarial (LLM01 / LLM05). An input/output scanner (LLM Guard) in front of the model raises the bar on injection and keeps known-bad output from coming back. Probabilistic, not a guarantee — layer it, don't rely on it.
• Then let students attack it. Turn your own box into the target for the red-team challenge — they'll try to make your tutor break scope or leak its prompt, and you'll watch the controls hold or fail. Best possible debrief: it's their classroom's assistant.

6 Use it with students

• Grounded tutor — Q&A over the readings, available all week, that only answers from your materials and abstains when unsure.
• Study-hall Socratic partner — a system prompt that asks guiding questions instead of handing over answers.
• "Spot the hallucination" — deliberately ask it something outside the corpus and have students catch the confident-but-wrong answer (LLM09, live).
• Red-team day — the security unit above: students attack the assistant you hardened.