AI Security
Red-team machine-learning systems: prompt injection, model extraction, and the security of LLM-powered applications.
Start Here — Foundations — no experience assumed
AI Literacy: Embeddings and Retrieval
How text becomes numbers, how similarity is computed, and what a RAG pipeline really does to a prompt. Worked by hand in three dimensions, then run for real on a CPU.
AI Literacy: LLM Mechanics
What happens between your prompt and the model's reply: tokenisation, the context window, the decoding loop, and the mechanism behind hallucination and non-determinism.
AI Literacy: The Confusion Matrix and Base Rates
TP/FP/TN/FN, precision and recall, and the base-rate arithmetic that decides whether a detector is useful or useless. Worked on the page, with a napkin method you can use in a meeting.
AI Literacy: Thresholds and Confidence
Threshold sweeps worked by hand, ROC and AUC explained without calculus, and the misconception that causes more misplaced trust in AI output than any other: confidence is not correctness.
Containers for AI Labs: Docker and Compose from Zero
Docker and Compose from zero — images vs containers, volumes, ports, logs, cleanup, and a worked compose.yaml that runs a local model.
Fundamentals of AI
AI vs ML vs DL vs GenAI, supervised vs unsupervised, what a model is as a file on disk, training vs inference, and an honest statement of what this track will not teach you.
Python for AI Work: Environments, Data, and Tests
venv/uv and committed lockfiles, HTTP and JSON, CSV and pandas, scikit-learn as an API only, the chat-completions message shape, and pytest as the grading mechanism.
Reading AI-Written Code: Review from Week One
A repeatable six-question review pass, then six flawed AI-generated snippets with the flaw, the cause, the fix, and a failing test.
Shell and Data Wrangling for AI Work
Terminal, filesystem, permissions, processes and ssh, plus the text-processing verbs used to inspect model output and datasets.
Build Your Skills — Intermediate — hands-on
Adversarial AI Evasion Under a Query Budget
Evade a phishing classifier you can train in seconds, but only through the API and only within a query budget — the way a real attacker has to.
AI Data & Model Attacks: The Backdoor That Passes Every Test
Plant a backdoor in training data, keep clean accuracy at 95%, flip every triggered input, and prove the model passes its tests anyway.
AI Lab: LLM-Assisted Log and Alert Triage
Run an LLM over a labelled alert corpus and find out where it helps, where it lies, and what it costs.
AI Lab: Model Supply Chain — When torch.load Is Remote Code Execution
A downloaded model file can own your machine on load. Prove it safely, then build the scan-and-refuse controls that stop it — and load only what you trust.
AI Lab: Securing a RAG Pipeline
Build a RAG stack on CPU, break it four ways, then drive the hidden attack tests from fail to pass.
AI Lab: Unbounded Consumption
Turn a summarisation pipeline into a cost bomb, then defuse it with four controls and re-plot the curve.
AI Security Essentials: Detection, Segmentation and Model Operations
ML detection and the base-rate problem, AI dev-environment segmentation, SIEM correlation, safe LLM use at work, model backups and drift — for beginners, with three CPU-only labs.
AI Security Essentials: Non-Human Identity and Behavioural Authentication
Non-human identities, the owner/expiry/review rule, agent authority and behavioural authentication, for beginners — with a CPU-only lab that builds a broker refusing to issue a bad credential.
AI Security Essentials: Poisoning, Bias and Governance
Poisoning, bias and AI under GRC, taught from first principles for beginners — with a CPU-only lab in which you backdoor a spam classifier you trained yourself.
AI Security Essentials: Start Here
Orientation for a four-page AI security series for beginners: the four framings that make every later topic recognisable, and a CPU-only Docker lab box you build once and reuse.
Excessive Agency
Exploit an agent with an unrestricted shell tool, then add an allowlist and approval gate and prove the same attack now fails. Before/after transcript grading.
Hidden Context Exposure
Extract a decoy API key from a system prompt, then re-architect so the secret is never in context. Flag capture plus a hidden pytest on every context payload.
LLM Output & Application Attacks
Insecure output handling: turn model output into XSS and command injection, then prove the fix blocks it. A two-stage grader script you run locally.
Prompt Injection Attacks
Direct and indirect prompt injection against a RAG chatbot you build yourself, graded on a canary flag string.
Go Advanced — Advanced — for practitioners
AI Governance with the NIST AI Risk Management Framework
The four AI RMF functions, the Generative AI Profile (AI 600-1), and the governance artefacts that turn framework prose into exit codes.
AI Lab: EU AI Act Article 50 Transparency in Code
Sign an asset with c2patool, verify it, tamper with it and watch verification fail — then implement the Article 50(1) chatbot disclosure. Graded on the verification exit code.
AI Lab: Satisfy a NIST RMF MEASURE Subcategory with garak
Scan llama3.2:1b with garak under Docker Compose, then turn the report into a NIST AI RMF MEASURE 2.7 evidence record. Graded on the artefact and the metric being in range.
AI Red Teaming: A Methodology
Scope, threat-model, attack, evidence and report an AI system — the discipline, not a list of jailbreak prompts.
AI-Augmented Penetration Testing
AI as the tester's tool: four genuine accelerants, the boundaries you never cross, and a graded checker that catches fabricated findings.
Applications of AI in InfoSec
Six real uses of AI in security work, the specific way each one fails, and the control that bounds it.
ISO/IEC 42001: The AI Management System, and How It Meets ISO 27001
AIMS clauses 4–10, the Annex A control themes, the Statement of Applicability as a checked file, and where ISO 27001 stops and 42001 starts.
Mapping an Incident to MITRE ATLAS
Map a public AI incident to ATLAS techniques, emit a Navigator layer, render a heat map, and grade it against MITRE's own data.
The EU AI Act After the Omnibus: Who Owes What, and When
Risk tiers, the provider/deployer split, GPAI duties, and the Article 50 transparency rules that are live right now.