Prompt Injection and Input Integrity
Proves the ability to design LLM and agent systems that stay safe when the model itself is successfully manipulated.
This practitioner exam assesses deep working knowledge of prompt injection: direct and indirect vectors, retrieval and tool-calling abuse, exfiltration channels, and the architectural controls that hold when probabilistic defences fail. It is aimed at engineers and security architects building or reviewing LLM applications and agents. Candidates are expected to reason about trust boundaries, not just recognise attack names.
- Injection vectors: direct input, indirect delivery via retrieved documents, email, web and RAG corpora
- Agent abuse: tool and function-calling manipulation, confused-deputy patterns and credential scope
- Exfiltration channels: markdown images, links and other zero-click egress from rendered output
- Probabilistic defences: delimiters, spotlighting and instruction hierarchy, and why they are not boundaries
- Output handling: model output as untrusted input to XSS, SQL and other downstream sinks
- Architecture: human-in-the-loop placement, allowlisting, and injection propagation across multi-agent systems
Learn the material
8 modules, about 60 minutes of reading. Work through them in order, or jump to whatever you need. The assessment is drawn from exactly this material.
- 01 Direct and Indirect Injection: the Delivery Path Defines the Class A precise taxonomy of injection by how the payload reaches the context, why indirect delivery is the harder engineering problem, and the inventory of carriers a real system exposes. 8 min
- 02 Retrieval, RAG and the Writable Corpus How a payload placed in a retrieval corpus actually reaches the model, why attackers optimise for retrieval rather than for indexing, and what trust a retrieved document can and cannot confer. 8 min
- 03 Tools, Function Calling and the Confused Deputy What a tool call mechanically is, why an agent holding a user token is a textbook confused deputy, and the specific ways tool access is abused after a successful injection. 7 min
- 04 Exfiltration Channels and Zero-Click Egress How injected instructions turn into data leaving the building, why rendered markdown images are the archetypal zero-click channel, and where the controls that actually work are located. 7 min
- 05 Delimiters, Spotlighting, Instruction Hierarchy and Guardrail Classifiers The family of probabilistic defences: how each one works, the precise reason each fails against an adaptive adversary, and how to describe them honestly in a design review. 8 min
- 06 Output Handling at Every Downstream Sink Treating model output as untrusted input to browsers, databases, shells and other models, and why the fix belongs at the sink rather than anywhere upstream of it. 7 min
- 07 Allowlisting Tools and Scoping Credentials The two architectural controls with the most leverage in an agent design, and the compromise test that tells you which of your controls are real. 7 min
- 08 Human Confirmation and Injection Propagation Across Agents Where an approval step adds real security value and how it decays into a reflex, and why passing messages between agents carries attacker influence across internal trust boundaries. 8 min
Take the assessment
18 questions drawn from the material above. Pass and you can put your name to a certificate with a serial anyone can verify.
How it is marked
- Questions and answer options are shuffled for every sitting.
- Multi-answer questions are marked as a set: you need all of the correct options and none of the wrong ones. There is no partial credit.
- You need 70% to pass.
- You can revisit and change any answer until you submit.
- Afterwards you see every question, the answer you gave, and whether it was right. The answer key is never printed.
- The reasoning behind each answer is released once you pass. Held back on a fail, it would hand over most of the key to anyone willing to sit the paper once and read it, which is why the taught material above is the intended route back.
- You can re-sit the paper, but not immediately: there is a ten minute wait between attempts on the same course.