LLM Security
Certified AI Red Team Engineer
Master AI, ML, and LLM security testing through hands-on red teaming, adversarial attacks, prompt injection, jailbreak techniques, and AI defense strategies.
Why this course exists
Large language models turned a text generator into a **component that takes instructions and
acts on them**. That is a much larger blast radius than a library bug: the model will happily
follow instructions that arrived inside a web page, a PDF, an email, or another user's chat
history, and it will do so without complaining, because following instructions is the entire
job.
This track teaches you to treat an LLM application as an application — with a trust boundary,
an input parser, a set of capabilities, and output sinks — and to test it the way you would
test anything else that executes attacker-influenced text.
What you will be able to do
- Map the components of an LLM application and identify which of them the attacker controls
- Run direct and indirect prompt injection against a chat endpoint and prove impact
- Break jailbreaks reliably, using role-play, encoding, multi-turn and competing-objective techniques
- Extract system prompts and sensitive context
- Turn model output into code execution, XSS, SQL injection and SSRF
- Poison retrieval corpora and manipulate tool calls in agentic systems
- Design layered guardrails and build the detection that catches an attack in progress
Assumed knowledge
HTTP, Python basics, and the OWASP Top 10 at the level of "I have read it". No machine
learning background is required; nothing here depends on model internals.
Syllabus
-
1
The LLM attack surface
What is actually running when a user "talks to the model", and which parts the attacker controls.
Locked -
2
Prompt injection and jailbreaks
Direct injection, indirect injection, and the jailbreak families that reliably defeat naive filters.
Locked -
3
Exfiltration and system prompt leakage
Getting the system prompt, the context and the training data to come back out.
Locked -
4
Insecure output handling
The completion is untrusted data. Here is every sink it can land in.
Locked -
5
RAG and tool-use poisoning
Attacking the context the model chooses, and the actions it is allowed to take.
Locked -
6
Model defence, detection and guardrails
Layered controls, honest threat modelling, and the telemetry that catches an attack mid-flight.
Locked
Final exam
Locked. Enrol in the course to unlock the final exam.