AI Red Teaming Course: 100 Labs, Attack & Defend LLMs

This course contains the use of artificial intelligence.

We only charge a fee solely for the time invested in building this comprehensive curriculum.

Adversarial AI Security is a hands-on course for security engineers, AI engineers, and red teamers who want to understand how LLMs and AI agents actually get attacked, and how to defend them. Across 100 labs, run entirely against your own local, authorized sandbox, you learn to execute prompt injection, jailbreaks, RAG poisoning, and agentic exploits, then build the layered defenses that stop them.

Most “AI security” content stops at a jailbreak screenshot. That tells you a model can be tricked. It doesn’t tell you whether your application, your RAG pipeline, your agent’s tool access, or your audit trail would survive the same attack in production. The gap between “I got the model to say something bad” and “I can defend a production AI system under a real red-team engagement” is the entire point of this course.

How the course works

Every lab runs against a local, intentionally vulnerable range that you build and control.Every offensive technique in this course is taught for the purpose of understanding and building defenses, never for use against systems you do not own or have explicit authorization to test.

What you’ll work with

• Docker, Kubernetes, Terraform, and Ollama for a local, air-gapped LLM sandbox

• Prompt injection, DAN-style jailbreaks, token smuggling, and encoding bypass techniques

• Llama Guard, NeMo Guardrails, and Pydantic-based output validation

• ChromaDB and Milvus, RAG poisoning, and RBAC-protected retrieval

• Model Context Protocol (MCP), agentic tool calling, and gVisor sandboxing

• mTLS, OpenAPI contract validation, and cryptographic approval gates

• Differential privacy, PII redaction, and model extraction and inversion concepts

• Trusted execution environment concepts, attestation, and encrypted weights

• PyRIT, MITRE ATLAS mapping, and CI-based red-teaming pipelines

• EU AI Act and DORA-style compliance evidence and audit trails

What’s inside

Module 1, Foundations and the Local Sandbox. You provision a local Kubernetes control plane, set it up with Terraform, and bring a Llama 3 model online with Ollama. You containerize the API with FastAPI and Docker, add logging, and lock the network down to an air-gapped policy, ending with a working local autonomous sandbox.

Module 2, The Anatomy of the Attack. You run direct prompt injection, build a DAN-style jailbreak persona, and work through token smuggling, encoding bypasses, and payload splitting. You also test translation-based and few-shot poisoning tricks before automating your findings with a fuzzer against your own local API.

Module 3, Architecting the Defense. You layer input and output guardrails: keyword filters, semantic similarity checks, Llama Guard classification, and NeMo Guardrails dialog control. You build a secondary LLM judge, enforce strict Pydantic output parsing, add rate limits, and tune sensitivity against false positives, then test your defenses against the fuzzer from Module 2.

Module 4, The Data Layer Threat. You stand up a local vector database and ingest data, then test indirect injection through documents, web search integrations, and markdown rendering. You study prompt leaking, vector store poisoning, and a time-delayed “sleeper agent” pattern, and demonstrate how data can be exfiltrated out of a RAG pipeline.

Module 5, Securing the Vector Store. You add RBAC to vector search, sign documents cryptographically, and sandbox document parsers. You detect anomalous embeddings, truncate context safely, verify citations against hallucination, sanitize markdown output, and encrypt vector data at rest and in transit, finishing with an audit trail design.

Module 6, Autonomous Danger: Agentic Exploitation. You define an agentic workflow around tools, memory, and MCP, then test what happens when an agent gets bash and Python execution. You explore tool-calling hijacking, SSRF through a web browser tool, privilege escalation, memory manipulation, and how a low-privilege agent can be used to attack a higher-privilege one.

Module 7, Zero-Trust Orchestration. You apply least privilege to LLM tools, sandbox execution with gVisor, and secure agent-to-tool traffic with mTLS. You enforce OpenAPI contracts, build cryptographic approval gates, destroy sandboxes after each task, monitor tool calls in real time, and segment agent workloads inside Kubernetes.

Module 8, Model Inversion, Extraction, and Privacy. You study model memorization, membership inference, and extraction attacks, then look at gradient inversion concepts. You apply differential privacy during fine-tuning, build PII redaction pipelines, review federated learning principles, and explore output watermarking and homomorphic encryption concepts.

Module 9, Hardware-Rooted Security and Sovereign Deployment. You study trusted execution environment concepts, confidential computing, and attestation for GPU nodes. You look at encrypting weights in memory and at rest, architecting an air-gapped high-availability cluster, zero-trust network access, HSM-based key management, and multi-region failover design.

Module 10, Advanced Red Teaming and Compliance. You automate red teaming with PyRIT, wire checks into a CI pipeline, and map findings to MITRE ATLAS. You build EU AI Act and DORA-style compliance evidence, design an incident response plan for a compromised agent, and run a tabletop exercise before the capstone briefing.

The Capstone: Lab 100

The capstone places you as the security architect for a simulated, highly sensitive AI deployment: an autonomous agent connected to a private vector database and a trading-style API through MCP. You are given 12 hours to build the full zero-trust architecture: guardrails, an encrypted and access-controlled RAG pipeline, sandboxed and mTLS-protected tool access, and immutable audit logs. An automated red-team fuzzer then attacks your build for 30 minutes with RAG poisoning, chained agentic exploits, and prompt injection.

Why now

LLMs and AI agents now call tools, query private data, and take actions with real consequences, which makes prompt injection, RAG poisoning, and agentic exploits practical risks rather than academic curiosities. The EU AI Act and DORA are pushing organizations toward logged, auditable, zero-trust AI deployments. This course builds the hands-on skills behind that shift. It does not promise a salary figure or a job, and it is not legal advice.

Start today

In Lab 1 you provision your local Kubernetes control plane, and by Lab 10 you’ll have a complete, air-gapped sandbox running your own model. Everything that follows happens inside that sandbox, under your control, from the first attack to the final defense.