AI Security Curriculum — FreakLabs Academy

A 9-level, 54-lesson curriculum on how AI systems fail and how to test them, from prompt injection through agents, supply chain, and red team practice.

LLM Fundamentals — How the Machine Works
1. Text Becomes Tokens
2. Attention: Every Token Sees Every Token
3. Can't Versus Won't
4. The Transcript Is the Program
5. The Trust Boundary That Isn't There
6. Threat-Modelling an AI System
Injection & Jailbreaks — Making It Say Things
1. Four Axes of a Prompt Attack
2. Multi-Turn Escalation
3. Encoding and Obfuscation
4. Jailbreak Versus Injection
5. Extracting the System Prompt
6. Writing a Prompt That Survives Being Read
Output Attacks — Making It Do Things to Your Users
1. Model Output Is Untrusted Input
2. Markup Injection Through Generated Output
3. Query and Command Injection Through Generated Code
4. Request Forgery Through Generated URLs
5. Encoding at the Sink
6. Schema-Valid and Hostile
RAG & Retrieval Security — Making It Read the Wrong Thing
1. Indirect Injection
2. Delivery Channels: Image, Audio, Cross-Modal
3. Similarity Is Not Trust
4. Retrieval Access Control and Provenance
5. Ingestion Security
6. Rates, Not Verdicts
Model & Data Attacks — Taking the Model Itself
1. Memorisation and Extraction
2. Membership Inference
3. Model Inversion and Attribute Inference
4. Model Extraction and Theft
5. Poisoning and Backdoors
6. Differential Privacy and the Privacy–Utility Curve
Agentic Security — Making It Act
1. What Changes When a Model Has Tools
2. The Confused Deputy and Least Agency
3. Memory, Persistence, and Dormant Compromise
4. Tool Design: Making the Dangerous Unrepresentable
5. Trust Between Agents and Cascade Failure
6. Approval Gates People Actually Read
Supply Chain & Infrastructure — The Things You Didn't Build
1. What You Can and Can't Verify About a Model
2. Loaders That Execute
3. Dependency Risk in a Fast-Moving Ecosystem
4. Connector Protocols and Inherited Trust
5. Deployment and Serving Infrastructure
6. Inventory: What 'Were We Affected' Costs
Detection & Response — Seeing It Happen
1. What Compromise Looks Like in Logs
2. Tool-Call Telemetry
3. Behavioural Baselines
4. Exfiltration Channels That Look Like Formatting
5. Incident Response for Systems That Act
6. Layered Defence, Honestly Rated
Red Team Practice — Doing It for Real
1. How AI Red Teaming Differs from Pentesting
2. Scoping, Authorisation and Rules of Engagement
3. Running a Campaign
4. Automation and Regression Against a Moving Target
5. Reporting That Drives Action
6. Frameworks as Maps