Securing AI & LLM Systems

What you will be able to do

• You will be able to map the attack surface of an LLM application across its model, system prompt, retrieval, tools, and agent components.
• You will be able to threat model an AI system using the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.
• You will be able to reproduce and classify direct and indirect prompt injection in real application flows.
• You will be able to explain how jailbreaks bypass model safety and why input filtering alone does not stop them.
• You will be able to assess training-data poisoning and backdoor risk across the model supply chain.
• You will be able to evaluate model theft, model extraction, and inference attacks such as membership inference and model inversion, and the controls that limit them.
• You will be able to design layered input and output guardrails that reduce injection, data leakage, and unsafe-output risk.
• You will be able to plan and run a structured red-team engagement against an LLM application and report findings with severity and remediation.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   The LLM Attack Surface and Threat Modeling

   You cannot defend what you cannot see. This module builds the mental model an AI security analyst needs: how a modern LLM application is assembled from a model, a system prompt, a context window, retrieval, tools, and agent loops, and where the trust boundaries sit between them. You then turn that map into a working threat model with the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.

   2 lessons · 5 quiz questions

2. 02

   Prompt Injection and Jailbreaks

   Prompt injection is the number one risk on the OWASP Top 10 for LLM Applications, and jailbreaks sit right beside it. This module separates direct injection (a user overriding the system prompt) from indirect injection (malicious instructions hidden in data the model reads), then shows how injected text turns an agent's own tools into exfiltration and abuse channels. You will also see how jailbreaks defeat a model's safety training, why the two failure modes (competing objectives and mismatched generalization) make them hard to remove, and why real defense has to be layered rather than dropped onto a single filter.

   2 lessons · 5 quiz questions · assignment

3. 03

   Attacks on the Model and Its Data

   Not every attack goes through the prompt. This module moves to the model itself and its supply chain: training-data poisoning and backdoors that corrupt behavior before deployment, then model theft, extraction, and the inference attacks (membership inference and model inversion) that steal capability or leak private training data. For each one you will learn how it works, what it costs an attacker, and the signals that expose it.

   2 lessons · 5 quiz questions

4. 04

   Guardrails and Red-Teaming

   Understanding attacks only matters if you can stop and detect them. This module turns the course into practice. First you design layered input and output guardrails (content classifiers, allowlists, output validation, and least-privilege tool scoping) as genuine defense in depth. Then you plan and run a structured red-team engagement against an LLM application and write findings that a team can actually remediate.

   2 lessons · 5 quiz questions · assignment