Course description
Defending Against Prompt Injection teaches security engineers, AppSec and platform teams, ML engineers and security leaders to protect LLM applications they own. You will learn what direct, indirect and multi-turn injection achieve, the preconditions and the evidence each leaves, and why filters and system prompt rules alone fail, from OWASP LLM01:2025, NIST AI 100-2e2025, MITRE ATLAS and published research summarized at a defender's level. In five labs on a local sample app with synthetic data you measure how often a harmless canary instruction in a retrieved document is followed, add least-privilege tools, human approval, output handling and structured input with provenance marking one at a time and re-measure, build a monitor that catches canary leakage across turns, and turn it all into a regression suite. The course ends with a prompt-injection defense plan, with tests, for one of your own applications. No attack payloads are taught. Last verified 2026-11-03.
About this course
A language model reads your instructions, the user's question and every document, email and tool result in one stream of text, and it does not enforce a boundary between them. Prompt injection is what happens when someone else's text is treated as your instructions. This course teaches security and engineering teams to defend applications they own: what direct, indirect and multi-turn injection achieve, why filters alone fail, and how to build layered controls whose effect you measure with harmless canary instructions on a local sample app. It is grounded in OWASP LLM01:2025 Prompt Injection, the OWASP Prompt Injection Prevention Cheat Sheet, NIST AI 100-2e2025, MITRE ATLAS and published research summarized at a defender's level. The course never teaches attack payloads: every test uses a harmless canary on your own system. The principles are vendor-neutral; where a control exists on ibl.ai, the course links the live documentation.
What you will be able to do
- Explain what direct, indirect and multi-turn prompt injection achieve, the preconditions each needs and the evidence each leaves, and map findings to OWASP LLM01:2025 and related entries, the OWASP Top 10 for Agentic Applications, NIST AI 100-2e2025 and MITRE ATLAS.
- Explain why input filters and system prompt rules alone cannot stop prompt injection, and place probabilistic and deterministic defenses where each belongs.
- Plan and run authorized self-tests with harmless canary instructions on synthetic data, and report each observable separately with its trial count and a confidence interval.
- Limit what an injection can do with least-privilege tools, privilege separation, human approval for consequential actions and safe output handling, all enforced outside the model, and verify each control by re-measuring.
- Keep untrusted content out of the instruction channel with structured input, delimiting and provenance marking, and measure their effect on your own model.
- Monitor whole conversations for canary leakage and injection signals across turns, respond with a runbook, and keep defenses tested with a regression suite that runs whenever models, prompts or tools change.
Who this course is for
Roles: security engineers, application security and platform teams, ML engineers and security leaders who build or run applications and agents on large language models.
Organizations: any sector. The examples include retail support, insurance, utilities and freight, all fictional.
Before you start: comfort reading Python and running commands in a terminal, and familiarity with access control and logging. The labs need Python 3.10 or later and nothing else; a model you are authorized to use is optional. All lab data is synthetic and supplied in the course.
Format
Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: five labs on a local sample app (measure a baseline, add controls one at a time, test structured input, build a conversation-level monitor, write a regression suite), with an AI tutor that coaches each step from the output you paste.
Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on labs, each ending in an AI assessment, and a capstone in which you write a prompt-injection defense plan with tests for one of your own applications, followed by a reading list.
Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.
Currency
Last verified 2026-11-03 against the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications for 2026, the OWASP Prompt Injection Prevention Cheat Sheet, the OWASP AI Testing Guide version 1, NIST AI 100-2e2025, NIST AI 600-1, MITRE ATLAS release 2026.10, the MCP specification revision 2026-07-28 and the ibl.ai documentation.
This field changes quickly. OWASP, NIST, MITRE and model vendors revise their guidance often, and models change between releases. Check the current versions and re-run your tests before relying on any page or template, and test only systems you own or are authorized to test. This course is training, not a security assessment of your systems.
Outline
Section 0 · Start here
- 0.1 Welcome and orientation
Section 1 · Understand what prompt injection achieves
- 1.1 Direct, indirect and multi-turn injection
- 1.2 Why filters alone fail
- 1.3 Section 1 assessment
Section 2 · Measure your exposure with harmless canaries
- 2.1 Authorized self-testing
- 2.2 Measure the baseline
- 2.3 Section 2 assessment
Section 3 · Layer the defenses and re-measure
- 3.1 Limit what an injection can do
- 3.2 Keep untrusted content out of the instruction channel
- 3.3 Section 3 assessment
Section 4 · Monitor conversations and keep testing
- 4.1 Detect injection across a conversation
- 4.2 Keep the defenses tested
- 4.3 Section 4 assessment
Section 5 · Capstone and wrap-up
- 5.1 Capstone: your prompt-injection defense plan
- 5.2 Capstone assessment
- 5.3 Reading list and next steps