AI Engineering / Working with LLMs
Security, Prompt Injection & Data Privacy
39 lessons in AI Engineering / Working with LLMs
- XSS from LLM HTML OutputCode Quiz
- Trusting Model Output for AuthorizationCode Quiz
- Blocking Sensitive Data ExfiltrationCode Quiz
- Sandboxing Model-Generated CodeCode Quiz
- Allow-List Before Downstream ActionCode Quiz
- Guarding Against Jailbreak OverridesCode Quiz
- Masking PII in Model OutputCode Quiz
- Opting Out of Provider TrainingCode Quiz
- Sanitizing URLs to Prevent SSRFCode Quiz
- Excessive Agency and Confused DeputySlides / Video
- OWASP Top 10 for LLM AppsSlides / Video
- GDPR & HIPAA for LLM DataSlides / Video
- Vendor Data Retention & Opt-OutSlides / Video
- Injection Risks in RAG DocumentsSlides / Video
- Redact PII Before EmbeddingCode Quiz
- Least-Privilege Design for Tool AccessSlides / Video
- Trusted Instructions vs Untrusted DataSlides / Video
- Wrong Role for User DataCode Quiz
- Over-Privileged Tool AccessCode Quiz
- Treating Documents as InstructionsCode Quiz
- Indirect Injection via Retrieved ContentCode Quiz
- Logging Raw Sensitive User DataCode Quiz
- Logging API Keys in PromptsCode Quiz
- Ungated Tool ExecutionCode Quiz
- Multi-Tenant Data IsolationQuiz
- RAG Injection via Retrieved DocsQuiz
- Provider Data Retention PoliciesQuiz
- Encryption In Transit and At RestQuiz
- Data Exfiltration via OutputsQuiz
- Trusted vs Untrusted Input SeparationQuiz
- Delimiting Untrusted ContentQuiz
- System Prompt LeakageQuiz
- Direct vs Indirect Prompt InjectionQuiz
- Excessive Agency in AgentsQuiz
- Least-Privilege for LLM ResourcesQuiz
- Preventing Secret Leakage in PromptsQuiz
- Data Exfiltration via LLM OutputsSlides / Video
- System Prompt Leakage and ExtractionSlides / Video
- Direct vs Indirect Prompt InjectionSlides / Video