Course Objective & Scope
Prompt injection is the number one risk in the OWASP Top 10 for LLM Applications: user input can override model instructions and lead to policy violations, data leakage or unauthorised actions. The course exercises direct attack techniques on a live chatbot, including role-play, encoding and obfuscation, many-shot and multi-turn (crescendo) jailbreaks, and system prompt extraction.
On the defensive side it covers instruction hierarchy, input/output classifiers, structured prompt design and least privilege. Participants leave with an attack catalogue and test set adapted to their organisation's own use case, plus an introduction to indirect prompt injection.
Who Should Attend?
- Software engineers building LLM-based chatbots and assistants
- AI and platform engineers
- Application security (AppSec) and penetration testing teams
- Prerequisite: basic Python and prior experience with an LLM API
Key Takeaways
- Classify and demonstrate direct prompt injection and jailbreak types
- Show why keeping secrets in the system prompt is unsafe
- Integrate input and output classifiers into an LLM application
- Run a repeatable injection test set with garak or promptfoo
- Measure the false-positive and latency cost of defensive layers
Curriculum
How LLMs Process Instructions
- System, developer and user messages; instruction hierarchy
- Instructions and data mixing in the same context window
Direct Prompt Injection and Jailbreak Techniques
- Role-play, encoding, language switching and obfuscation
- Many-shot and crescendo-style multi-turn attacks
- System prompt extraction
Attack Lab
- Targeted attacks against a sample customer assistant
- Success criteria and documenting the attack catalogue
Detection and Filtering Layers
- Classifiers such as Azure AI Prompt Shields and Llama Prompt Guard
- Output inspection and policy checks
Secure Prompt and Application Design
- Structured prompts, delimiters and least privilege
- Introduction to indirect prompt injection: the widening attack surface
Automated Testing and Regression
- Injection test sets with garak and promptfoo
- Measuring latency and false positives of defences
Other Courses in This Category
-
Covers hidden instructions delivered through web pages, emails, documents, RAG sources and MCP tool outputs, data exfiltration chains, and architectural defences such as spotlighting, the dual-LLM pattern and CaMeL.
- Live Course
- 5 modules
-
Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.
- Live Course
- 5 modules
-
Shows how to control excessive functionality, permissions and autonomy granted to AI agents using tool design, parameter validation, approval flows and an agent permission matrix, based on OWASP LLM06 and agentic risk guidance.
- Live Course
- 5 modules
-
Explains how poisoned documents planted in a knowledge base manipulate retrieval results and LLM answers, and how to prevent this with ingestion pipeline controls, source trust scoring and retrieval anomaly monitoring.
- Live Course
- 5 modules
-
Covers pickle-based code execution, backdoors, licensing and provenance risks in models sourced from hubs such as Hugging Face, and how to manage them with safetensors, ModelScan, model signing and an AI-BOM (CycloneDX).
- Live Course
- 5 modules
-
Teaches how to prevent confused deputy and privilege escalation risks in autonomous agents through workload identity, OAuth 2.0 On-Behalf-Of delegation, dynamic scope attenuation and OPA/Cedar policy enforcement.
- Live Course
- 5 modules
Get in touch
