AI Security Engineering · Module 00
Instructor Guide
Teaching intent: Build a precise security-practitioner mental model. Learners do not need to train a large model or derive Transformer mathematics. They must accurately trace data, parameters, context, authority, versions, and metrics.
Mandatory terminology rules
- A model is one component of an AI system.
- Inference and ordinary RAG do not update model parameters.
- Prompt engineering is not authorization.
- Attention is not a factuality mechanism.
- Model-selected is not application-authorized.
- Safety, security, privacy, robustness, fairness, and reliability are not synonyms.
- Every metric requires a task, dataset, threshold or aggregation, and limitation.
- Qualify overloaded terms using the canonical glossary.
Run of show
| Block | Teaching move | Exit evidence |
|---|---|---|
| AI map and tasks | Build the hierarchy and classify familiar systems | Model versus system distinction |
| Learning and data | Trace a phishing classifier through splits and metrics | No leakage; task and costs defined |
| Neural networks | Walk forward pass, loss, gradient, optimizer | Parameters versus hyperparameters |
| Transformer and LLM | Tokenize examples and trace next-token generation | Tokens, attention, logits, decoding understood |
| LLM lifecycle | Compare prompting, RAG, PEFT, SFT, DPO, quantization | Learner selects correct adaptation method |
| RAG | Draw ingestion and query paths separately | Authorization before prompting; lineage preserved |
| Agents and MCP | Separate host, client, server, tool, resource, prompt | Authority enforced outside model |
| Evaluation and MLOps | Challenge a context-free “95% accuracy” claim | Decision-relevant metrics and versions |
| Practical | Trace baseline, RAG, and MCP-agent architectures | Complete data/identity/telemetry trace |
| Check | Use the knowledge questions | Pass or remediation |
Common misconceptions and corrections
| Misconception | Correction |
|---|---|
| “The model learned the retrieved document.” | It received retrieved chunks in inference context; weights were not updated. |
| “Embeddings are encrypted text.” | They are learned vectors; they are not encryption and may leak sensitive information. |
| “Temperature zero is deterministic.” | It narrows decoding randomness, but runtimes and APIs may still vary. |
| “The system prompt has highest security privilege.” | It is model context, not a deterministic enforcement boundary. |
| “MCP authorizes tools.” | MCP defines interaction; applications and deployments enforce authentication, authorization, consent, and isolation. |
| “A high accuracy score means the agent is safe.” | Accuracy covers a defined prediction task and says nothing by itself about agent authority, security, or harm. |
Assessment
| Criterion | Weight |
|---|---|
| Accurate concept relationships and terminology | 25% |
| ML and LLM lifecycle trace | 20% |
| RAG architecture and retrieval controls | 20% |
| Agent/MCP identity and authority trace | 20% |
| Metric selection and limitations | 15% |
Pass standard: 70% overall and at least 8/10 on the knowledge check. Require revision if the learner conflates training with inference, RAG with fine-tuning, model with system, or tool selection with authorization.
Preparation
- Review the glossary and current MCP architecture documentation.
- Prepare one tokenizer demonstration without sensitive data.
- Choose a simple classifier example relevant to the audience.
- Prepare baseline LLM, RAG, and agent architecture diagrams.
- Do not require external model accounts; conceptual traces are sufficient.
- Record terminology changes between course releases.