Visão Geral

Este curso aborda Prompt Injection e principais riscos de segurança em aplicações baseadas em IA Generativa, incluindo manipulação de instruções, extração de informações, uso indevido de ferramentas e mecanismos de defesa.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender ataques de Prompt Injection
• Identificar riscos em aplicações de IA
• Avaliar controles de segurança
• Implementar medidas defensivas

Publico Alvo

• AI Security Professionals
• Cybersecurity Professionals
• Developers
• Security Engineers

Pre-Requisitos

• Conhecimentos básicos de LLMs
• Familiaridade com IA Generativa
• Conhecimentos de segurança de aplicações
• Noções de APIs
• Conhecimentos básicos de Prompt Engineering

Conteúdo Programatico

Module 1: Prompt Injection Fundamentals

1. Prompt Injection concepts
2. Direct Prompt Injection
3. Indirect Prompt Injection
4. Instruction hierarchy
5. System prompts
6. User-controlled inputs
7. Context manipulation
8. Attack surfaces
9. Prompt Injection threat modeling
10. Prompt security fundamentals

Module 2: LLM Application Attack Surface

1. LLM application architecture
2. User inputs
3. Retrieval-Augmented Generation
4. External data sources
5. Tool calling
6. Plugins and integrations
7. APIs
8. Application permissions
9. Output handling
10. Attack surface analysis

Module 3: Prompt Injection Risks

1. Instruction manipulation
2. System prompt exposure
3. Sensitive information disclosure
4. Context poisoning
5. Data exfiltration
6. Tool misuse
7. Unauthorized actions
8. Model behavior manipulation
9. Multi-step attack chains
10. Prompt Injection impact analysis

Module 4: Indirect Prompt Injection

1. External content
2. Retrieved documents
3. Web content
4. Emails
5. Knowledge bases
6. Malicious documents
7. RAG poisoning
8. Trusted data sources
9. Indirect attack detection
10. Indirect Prompt Injection defense

Module 5: AI Application Security

1. Input validation
2. Output validation
3. Content filtering
4. Tool authorization
5. Least privilege
6. Context isolation
7. Data access controls
8. Secure RAG
9. Application sandboxing
10. Secure AI architecture

Module 6: Detection and Monitoring

1. Prompt monitoring
2. Suspicious instruction detection
3. Tool usage monitoring
4. Output monitoring
5. Data access monitoring
6. Anomaly detection
7. Security logging
8. Incident detection
9. Prompt Injection indicators
10. AI security monitoring

Module 7: AI Security Testing

1. AI threat modeling
2. Prompt security assessment
3. Application testing
4. RAG security assessment
5. Tool security assessment
6. Access control testing
7. Data leakage testing
8. Security control validation
9. Risk assessment
10. AI security testing methodology

Module 8: Practical Prompt Injection Defense

1. Prompt Injection assessment
2. Direct attack analysis
3. Indirect attack analysis
4. RAG security assessment
5. Tool authorization review
6. Data protection assessment
7. Detection implementation
8. Defensive control validation
9. Security reporting
10. Prompt Injection and AI security case studies