Classify LLM application attacks using the OWASP Top 10 for LLM applications as a working taxonomy.
Digital Transformation & Artificial Intelligence
Adversarial Testing and Prompt Injection Defences for LLM Applications
Learn to red-team LLM applications against prompt injection, jailbreaks and data exfiltration, and build layered defences that hold up under repeated adversarial testing.
🗓️Duration5 training days
📚Content4 modules · 8 sessions
🎓On completionAccredited attendance certificate
About the programme
Course Overview
An LLM application that behaves correctly in a demo can still be manipulated into leaking a system prompt, executing an unauthorised tool call or producing content its owner never intended, because language models cannot reliably distinguish trusted instructions from adversarial text buried in a document, email or web page they process. This course trains security and engineering teams to find those weaknesses before an attacker does, working through the main attack classes in the OWASP Top 10 for LLM applications: direct prompt injection, indirect injection carried in retrieved content, jailbreak techniques that bypass safety training, and insecure output handling that turns a model's response into a downstream vulnerability. Participants build and run adversarial test suites against a real or sample LLM application, then design layered defences, including input segregation between trusted instructions and untrusted content, output filtering before a response reaches a user or another system, and sandboxing of tool calls so a manipulated model cannot take unauthorised action. The course closes with how to keep testing current as new jailbreak techniques circulate and as the application itself changes. Participants leave with a completed adversarial test suite, a set of confirmed findings and a defence plan mapped to each finding.
Expected Learning Outcomes
Design and run direct prompt injection tests against a live or sample LLM application.
Construct indirect prompt injection payloads delivered through retrieved documents or web content.
Test jailbreak techniques that attempt to bypass a model's safety training and content restrictions.
Assess insecure output handling risks where a model's response is passed unchecked to another system.
Design input segregation and output filtering controls that reduce the application's attack surface.
Sandbox tool calls and agent actions so a manipulated model cannot take unauthorised action downstream.
Who Should Attend
Application security engineers testing LLM-integrated products
AI engineers building retrieval-augmented and agentic applications
Red team specialists extending scope to generative AI systems
Product security leads accountable for AI application risk
Platform teams building shared LLM infrastructure and guardrails
Security architects designing defences for AI-enabled applications
Course Modules
Select any module to see its sessions and points.
01Understanding the Attack Surface
2 sessions · 8 points
Session 1The OWASP Top 10 for LLM Applications
- Walk through the current OWASP categories relevant to prompt injection, output handling and supply chain risk.
- Distinguish vulnerabilities specific to LLM applications from conventional web application security issues.
- Map an example application's architecture to identify where each category of risk is most likely to appear.
- Prioritise which categories to test first based on the application's data sensitivity and permissions.
Session 2Direct and Indirect Prompt Injection
- Distinguish direct injection typed by a user from indirect injection hidden in retrieved or referenced content.
- Construct test payloads that attempt to override a system prompt through conversational input.
- Embed injection payloads inside documents, web pages or emails an application might retrieve or summarise.
- Evaluate whether the application treats retrieved content as data or mistakenly executes it as instruction.
02Running Adversarial Tests
2 sessions · 8 points
Session 1Jailbreak and Safety Bypass Techniques
- Test role-play and persona framing techniques that attempt to bypass content restrictions.
- Test multi-turn manipulation that gradually shifts a conversation past a model's initial refusal.
- Evaluate encoding and obfuscation techniques used to smuggle restricted content past filters.
- Record which jailbreak techniques succeed against the specific model and configuration in use.
Session 2Building and Executing a Test Suite
- Assemble a repeatable adversarial test suite covering injection, jailbreak and output handling categories.
- Automate regression testing so the suite reruns whenever the prompt, model or application configuration changes.
- Score findings by exploitability and impact to prioritise which weaknesses require immediate remediation.
- Report findings to engineering in a format that maps directly to a specific fix, not a general warning.
03Designing Layered Defences
2 sessions · 8 points
Session 1Input Segregation and Prompt Hardening
- Separate trusted system instructions from untrusted user and retrieved content at the architecture level.
- Apply prompt hardening techniques that reduce, without eliminating, susceptibility to override attempts.
- Use a secondary model or classifier to screen inputs for known injection patterns before the main call.
- Limit the context window's exposure to untrusted content where the task does not require full documents.
Session 2Output Filtering and Tool Call Sandboxing
- Filter model output for known unsafe patterns before it is displayed or passed to another system.
- Treat model output as untrusted input to any downstream system, never execute it directly.
- Sandbox tool calls and agent actions behind explicit permission checks rather than trusting the model's request.
- Log every tool call an agent makes so anomalous or unauthorised actions can be traced after the fact.
04Sustaining Defences Over Time
2 sessions · 8 points
Session 1Keeping Pace with New Techniques
- Monitor public disclosure of new jailbreak and injection techniques relevant to the models in use.
- Retest the application whenever the underlying model version or provider configuration changes.
- Establish a bug bounty or responsible disclosure route specific to AI application vulnerabilities.
- Review incident reports from production for signs of injection attempts missed by prior testing.
Session 2Embedding Testing into Development
- Integrate adversarial test suites into the deployment pipeline so releases are tested before going live.
- Train application developers to recognise injection risk when designing new prompts or tool integrations.
- Set a minimum testing bar new LLM features must pass before receiving production approval.
- Review third-party plugins and connectors for injection risk before they are enabled in production.
What the participant receives
4 course modules
A structured syllabus
8 training sessions
across 5 days
32 detailed points
Applied, detailed content
Accredited attendance certificate
On completing the programme
Complete your registration
We will contact you within one business day to confirm.
Ready to start?
Reserve your seat and start building the skill.