Welcome to the AI Security Bootcamp! AISB is a 7-day intensive program for senior security professionals, focused on frontier AI Security. This repo contains the exercises and links to the reading material you will go through during the bootcamp.

Complete Day 0 - Setup before the bootcamp. Each content day starts with a one-hour lecture followed by six hours of paired labs; review the required background in each section's README beforehand.

Day 1 - LLM Internals

• 1.0 - Pre-reading: how LLMs are trained
• 1.1 - LLM internals and chat serialization: tokenization, chat templates, and special tokens
• 1.2 - Log probabilities: output distributions as an attack surface for extraction and adversarial optimization
• 1.3 - Instruction hierarchies and assistant prefills (optional): instruction priority and prefill attacks
• 1.4 - Prompt injection and RAG poisoning: attacks across the boundary between trusted instructions and retrieved data
• 1.5 - RAND report: securing AI model weights: security levels (SL1–SL5) and operational capability tiers (OC1–OC5)

Day 2 - Coding Agents & AI Control

• 2.1 - Coding-agent attack surface and affordances: code execution, tool restrictions, and attack patterns
• 2.2 - AI-control monitoring: adaptive evasion and evaluation with trusted and untrusted models
• 2.3 - AI-control protocols: trusted monitoring, defer-to-trusted, resampling, and safety–usefulness tradeoffs
• 2.4 - Safety simulator (optional): from monitor scores to system-level safety estimates

Day 3 - LLM Inference Security

• 3.1 - Tokenization and prompt construction: security-relevant generation behavior
• 3.2 - Jailbreaking: techniques for bypassing learned safety behavior
• 3.3 - Guardrails: keyword filters, classifier-based monitors, LLM-as-judge, and optional linear probes on activations
• 3.4 - Knowledge-distillation attacks: transferring capabilities from teacher outputs to a student model
• 3.5 - Model weight extraction via SVD: inferring hidden dimension and extracting the output projection from logit queries

Day 4 - Training & Data Security

• 5.1 - Model editing: surgical weight manipulation to rewrite model behavior
• 5.2 - Backdooring: backdoors injected via fine-tuning and data poisoning
• 5.3 - Undoing safety fine-tuning: refusal-direction ablation and abliteration
• 5.4 - Removing safety behavior with LoRA fine-tuning (optional, instructor-recommended alternative)

Day 5 - Adversarial ML

• 6.1 - Adversarial attacks on vision models: adversarial examples and gradient-based attacks against image classifiers
• 6.2 - Discrete adversarial optimization with GCG: optimizing adversarial token sequences against language models
• 6.3 - Continuous adversarial prefixes: optimizing prefixes in embedding space
• 6.4 - Image provenance and watermark robustness (optional)

Day 6 - Infrastructure Security

• 6.1 - Side-channel hardware monitoring
• 4.2 - Agent swarm incident response

Day 7 - Infrastructure Security & Threat Modeling

• 7.1 - Threat modeling with adversary matrices: MITRE ATLAS and frontier-lab threat models
• 7.2 - NVIDIA Container Toolkit vulnerability: trust boundaries and CVE-2025-23266 (NVIDIAScape)
• 7.3 - GPU RowHammer: page-table corruption, DMA isolation limits, and privilege escalation

Please review the Day 0 setup guide to ensure you have the required skills and tools to complete the bootcamp.

If you're attending the bootcamp in person, you will spend most of the days pair programming with your assigned partner on the exercises for the given day.

Before the first day, make sure you have completed the instructions in the Day 0 setup guide.

Each content day is split into numbered section folders named X.Y-topic, where X is the day and Y is the section. Follow the section links in the curriculum overview above; 1.0-readings contains Day 1 pre-reading. Day 4 content is under development. Start with each section folder's README.md: it explains what the section assumes, what you should learn, and which pre-reading and reference resources will help. Then open the *_instructions.md file for the exercises. We recommend you open it in your IDE and view the markdown (right-click and select "Open Preview" in VS Code).

The README background is part of the section: review it before beginning the exercises. Only resources explicitly marked optional longer reading may be skipped. In each prerequisite table, you should be able to demonstrate every incoming competency with a short question or task; - means that the section has no additional prerequisite in that category.

For each section containing code, create a day#_answers.py file in that section's folder. Prose-only sections specify a Markdown answer file instead.

The instructions will contain code snippets you need to complete. Add a new # %% line to your answers and paste the code snippet under that line. If you went through the setup instructions correctly (with VS Code), you should see "Run Cell" option above the # %% which will execute the code in a Python Interactive Window. The code snippets contain tests that should initially fail. Complete the TODOs in the code and run the cell until all the tests pass.

We recommend you save your progress for each day (the answer files you will create with your assigned partner) to a branch in this repo. This will make it possible for you to switch between computers you will use while pair programming, and make your solution available for you to reference later.

First, configure your git repo with:

git config pull.rebase true
git config --type bool push.autoSetupRemote true

Every day in the morning, make sure you have the latest version of the repo:

git checkout main
git pull

Make a branch for the day: git checkout -b <branch name>, where your branch name should follow the convention day#/<name>-and-<name>. For example, if Tamera and Edmund were pairing on the day 3 content, the command would be git checkout -b day3/tamera-and-edmund. If you share a first name with someone else in the program, use a unique nickname of your choice for disambiguation.

Create a new file for your answers (see completing exercises above) and work through the material with your partner.

As you work, commit changes to your branch and push them to the repo. To make and push a commit:

git add :/
git commit -m '<your commit message>'
git push

If you want to switch what computer you work on with your partner, they can check out the latest version of the branch with:

git fetch
git checkout <branch name>
git pull

If you'd like to try a sample exercise and test your setup, go ahead and complete day0!

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.