From the lab
You'll watch your own model being trained — live
Not someone else's results. A real run from the course: a model trained from scratch on a live GPU — loss falling from 11.0 to ~3.4 over a budget-capped 3-hour run.
Two days of deep engineering — not prompt tricks. You'll build a language model from scratch, train it live on a GPU, tune it the way the frontier labs do, turn it into a chatbot, then secure the whole stack against OWASP AISVS — the world's only security verification standard for AI. You leave with the model you built, the toolkit, and the playbook.
The market is flooded with "prompt engineering" and API-wrapper courses. This is not that. This is the engineering tier: you will stand up a real training run, see the loss fall in real time, apply the techniques that separate a working model from a competitive one, and then do the thing the field is almost entirely missing — secure the model and its delivery stack to a formal standard.
Taught by the founder of CyberSecAI and the former OWASP-AISVS Co-Leader (v1.0). You will not get a slideware overview. You will build, break, and harden, with the tooling in your hands.
Modern architecture, a curated dataset, and a live GPU run that produces a real, auditable model — yours to keep.
The stability and efficiency techniques that make models train cheaper and perform better. The playbook the labs don't publish.
Threat-model and harden the full stack — model, RAG, MCP, agents — and verify it against the world's only AI security standard.
Classes are custom built from the following learning modules. Instructors select ~16 hours for a 2-day delivery, tailored to the audience. Custom formats from 1 to 5 days available. (Times are approximate.)
What is inside the weights: parameters, layers, attention, and why "it's just matrix multiplication" is both true and misleading.
BPE tokenizers, vocabulary design, and why tokenizer choices become security and cost decisions later.
From static vectors to contextual embeddings; what "the model understands" really means.
Self-attention step by step, on paper and in code, with a working minimal implementation.
RMSNorm, RoPE positional encoding, grouped-query attention, SwiGLU and QK-norm: what each does and why every serious model since 2023 uses them.
Parameters vs data vs compute; reading a scaling decision the way a lab does.
Where training data comes from, provenance, and the legal exposure hiding in a corpus.
Quality filtering, heuristic cleaning and education-value scoring on a real open corpus.
MinHash dedup hands on: why duplicated data poisons evaluation and inflates memorization risk.
How poisoned samples enter a corpus, what they do to a trained model, and pipeline controls that catch them.
Loss, gradients, optimizer state; reading a loss curve like an engineer.
Warmup-stable-decay schedules, z-loss, gradient clipping: the tricks that keep runs alive.
The class launches a real ~180M-parameter training run and watches it learn in real time, from gibberish to grammar. live GPU
Perplexity, held-out evaluation, and honest measurement of a small model.
Instruction tuning and fine-tuning: what changes, what it costs, and when fine-tuning an open model beats building.
Running your model behind an OpenAI-compatible endpoint; the moment it becomes an attack surface.
Shrink your model to run anywhere -- INT8/INT4 and GGUF -- and the size-vs-speed-vs-quality trade-offs of real deployment.
How text becomes vectors, building and querying an embedding store, and the security pitfalls that follow.
What breaks when you point ASVS-era thinking at an AI system; the origin and intent of AISVS, from the former Co-Leader (v1.0).
A guided tour of the whole standard: what each category verifies and how they interlock into one architecture.
L1/L2/L3: cumulative levels, choosing a target level for a system, and what regulators and buyers will ask for.
EU AI Act, NIST AI RMF and ISO 42001 in relation to AISVS; the standard as the engineering layer under governance frameworks.
Live injection against the class model and a RAG pipeline; why filtering alone always loses.
Roleplay, encoding and multi-turn attacks against the model's safety behaviour.
Poisoned documents, embedding-space tricks and retrieval manipulation against the lab's vector database. Hands on with dvrag.
Membership inference, training-data regurgitation, and model-stealing techniques against the class model.
Malicious model files, compromised dependencies, Hugging Face risk surface, and what a backdoored checkpoint looks like.
Unbounded allocation, oversized payloads, and the CWE-770 pattern that affects every major MCP SDK.
Confused deputy, tool-poisoning, and what happens when an agent acts on adversarial retrieval. Hands on with dvmcp.
Authentication, transport, injection and tool-integrity attacks -- attacked and defended against a deliberately-vulnerable MCP server.
Use AI to accelerate vulnerability research and build proof-of-concepts -- with responsible-disclosure discipline throughout.
Documenting the system, assigning ownership, and the risk assessment requirements.
Hands on: deploying Presidio and prompt-guard tooling to block injection, PII leakage and malformed input before it reaches the model.
Signed model artefacts, provenance tracking, and supply-chain verification with SBOM tooling (Syft, Grype, Cosign).
Secure inference runtime configuration, request authentication, rate limiting, and the boundary where crypto controls live.
OPA policy-as-code, fail-closed authorization, agent identity (ECDSA P-256 signed credentials), and zero-trust architecture for AI.
Dependency scanning, container image signing, and the difference between "scanned" and "verified" in an AI deployment pipeline.
Hands on: sensitive-entity-only output redaction, stopping the model from leaking what the input guards caught.
Vector database access control, embedding isolation, and encryption at rest for the knowledge store.
Multi-agent isolation, trust-gated actions (L0-L4), human-in-the-loop for critical operations, and signed execution receipts.
Tool integrity verification, per-message signing (MCPS), and preventing prompt injection through tool responses.
Hands on: red-team the secured stack with promptfoo and garak; verify that the controls deployed actually hold.
Tamper-evident audit trails, hash-chained receipts, anomaly detection, and what an incident responder needs from an AI system's logs.
Full supervised lab: tokenizer, dataset, training run on cloud GPUs, evaluation and checkpoint export. live GPU
Competitive red-team exercise against a hardened RAG pipeline and agent stack; scored on findings. dvmcp dvrag
Run the Claw scanner against the class stack, review the gap report, deploy fixes, and re-scan to verify closure. Claw OWASP AISVS
Deploy the full stack (model + RAG + agent + controls) to a cloud environment and verify every AISVS control fires as designed.
Train a small, real prediction model end to end on the GPU -- your data, features, model, evaluation. The "build an AI, not just prompt one" skill.
Construct a working agent -- tools, planning, memory -- and the human-in-the-loop controls that keep an autonomous system safe.
Not someone else's results. A real run from the course: a model trained from scratch on a live GPU — loss falling from 11.0 to ~3.4 over a budget-capped 3-hour run.
Attack and defend real targets — prompt injection, tool poisoning, retrieval poisoning, unsafe output — with purpose-built tools we created for testing AI systems, then grade the results against OWASP AISVS.
A security scanner for MCP servers, AI agents and RAG stacks — probes them for real vulnerabilities and grades the results against published OWASP standards.
The world's only AI security verification standard — the level-based controls you'll verify your own stack against, taught by the former Co-Leader of the standard (v1.0).
A sample of the concrete, technical ground we cover. You leave able to talk about — and work with — every one of these:
Tokenization, attention & KV-cache, rotary positions (RoPE), grouped-query attention (GQA), RMSNorm, SwiGLU, mixed-precision (bf16/fp16).
Data curation & dedup, learning-rate schedules, gradient behaviour, training stability, hyper-parameter transfer, and budget-capped GPU runs.
Quantization (INT8/INT4, GGUF), KV-cache management, batching and throughput, and the size-vs-speed-vs-quality trade-offs of deployment.
Supervised fine-tuning (SFT) and parameter-efficient methods (LoRA-style adapters) — the approaches worth knowing, and their pitfalls.
eBPF-based runtime observability of AI workloads, syscall & network-egress visibility, sandboxing untrusted models and tools, workload identity.
MCP transport & auth, RAG retrieval pipelines, embedding/vector-store security, and multi-tenant isolation.
Go beyond fine-tuning APIs — understand and control the full model lifecycle.
Move into AI engineering with real, hands-on depth instead of buzzwords.
Design AI systems you can actually reason about, secure, and defend.
Differentiate on security and provenance — and prove it to your customers.
Operate, monitor, and harden AI workloads with the right controls.
Add AI to your remit with a standards-based, hands-on toolkit.
Prerequisites: a basic engineering background — comfort with the command line and a little Python. No prior machine-learning experience required; we build the mental model from the ground up.
Plenty of courses teach you to build. This is the only one that teaches you to build and verifiably secure your AI to a formal standard — taught by the former Co-Leader of that standard (v1.0).
The OWASP Artificial Intelligence Security Verification Standard (AISVS) is the AI-era equivalent of ASVS: a structured, level-based set of controls for delivering AI securely. You won't just hear about it — you'll verify your own stack against it.
Modern AI isn't one box — it's eight layers spanning untrusted, perimeter, control, model, knowledge, action, data and infrastructure zones, with trust boundaries between every one. You'll learn to reason about each layer and verify the controls that cross them, straight from the OWASP AISVS reference architecture:
OWASP AISVS Reference Architecture — the 8 layers of a modern AI system, the trust boundaries between them, and the 12 AISVS chapters mapped to each layer. This is the map you'll learn to secure.
Raza Sharif is a recognised authority on the secure design and delivery of AI and a world-class cyber-security leader. He is a Fellow of the British Computer Society (FBCS) and founder of CyberSecAI, and former Co-Leader of the OWASP Artificial Intelligence Security Verification Standard (AISVS) (v1.0), the world's only security verification standard for AI.
He is the author of "Breach 20/20" on data-breach prevention, with deep roots in cyber-forensics — digital evidence, chain of custody, admissibility — and he builds the very tools he teaches: from-scratch model-training pipelines, model-forensics auditing, and OWASP-mapped security scanners. This is engineering from someone who ships, not theory from someone who reads.
You will leave with a model you trained, a toolkit you can use Monday morning, and the rare ability to build, optimize, and secure AI to a formal standard. Seats are deliberately limited so the hands-on stays hands-on.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.
