AI Security Fundamentals Series for Professionals

by jassics
genai security series

Securing the systems that don’t run on rules anymore.

This page is the index for the series — every planned category and article, with a line on what it covers. Links go live as each piece publishes; everything else is marked (coming soon). Bookmark this page — it will keep growing.

It’s a field-guide library on GenAI and agentic AI security — how these systems work, how they fail, and how to defend them — written for security architects, ML engineers, and anyone building AI products that need to survive contact with the real world, with examples, possible diagrams, and code snippets.

ToC for GenAI Series (50+ articles)

  1. Start Here — GenAI Foundations
  2. Agentic AI — Build It, Then Secure It
  3. AI Inference & Production Operations
  4. Responsible AI & Explainability
  5. AI Voice Agents
  6. Data, Model & Infrastructure Security
  7. Industry Playbooks & the Threat Landscape
  8. Building the AI Security Career & Function
A visual representation of 'The GenAI Security Series', outlining 8 categories and a total of 58 articles including titles such as 'GenAI Foundations', 'Agentic AI', 'AI Inference & Production Operations', and more.

1. Start Here — GenAI Foundations

The vocabulary and mental models everything else in the series assumes — read these first if terms like “transformer,” “RAG,” or “agentic loop” aren’t yet second nature.

Two AI paradigms, two threat models — why a stop-sign sticker attack and a chatbot inventing a refund policy are different failures that demand different defenses.

The full vocabulary spine from transformer to agentic engineering, in the order the industry actually built it — so the rest of the series reads cleanly.

What a large language model actually is, how it works mechanically, and what you can build with one — before the attention-mechanism math.

A decision-first guide to picking the smallest model that clears your quality bar, and what a bigger one costs you in money and attack surface.

When to fetch knowledge at query time versus preload and freeze it into context — and what each choice costs in latency, spend, and attack surface.

The technique catalogue every later article assumes — zero-shot, few-shot, chain-of-thought, self-consistency, tree-of-thought, and ReAct — with worked examples, code, and the security failure mode each one opens up.

Every risk from LLM01 Prompt Injection to LLM10 Unbounded Consumption, walked through with real-world incidents, sandbox-runnable attack payloads, annotated data-flow diagrams, and working code for each mitigation — step by step, not just a checklist.

A 19-chapter, zero-to-hero primer for interns and junior engineers — from “what is a token?” to the full OWASP LLM and Agentic attack playbook.

02 · Agentic AI — Build It, Then Secure It

Agents are where GenAI’s blast radius stops being theoretical. This is the deepest thread in the series: how agents are built, and every layer of how they’re attacked and hardened.

What an agentic system actually is, the perceive–reason–act loop, the agentic stack, and building your first tool-using agent in 30 minutes.

The OWASP Agentic Top 10, real incidents like EchoLeak, and the defense-in-depth architecture — Intent Gate, Zero Trust, sandboxing — that hardens an agent end to end.

Each agentic-specific risk — memory poisoning, tool misuse, cascading hallucination, rogue-agent action — dissected with attack-chain diagrams, reproducible PoC code, and the concrete control that closes it, one risk at a time.

Why “confused deputy” is the signature agentic failure, and the identity fabric — delegation, workload identity, on-behalf-of tokens — that closes it.

The infrastructure layer that turns a stateless model into a running agent: its seven internal layers, the control loop, and how to secure it.

How agents talk to tools, to each other, and to the world — the protocol landscape explained as layers, not competitors, with a decision tree for which to adopt.

The human-memory analogy for episodic, semantic, and procedural agent memory — what each is for, the tools that implement it, and how memory gets poisoned.

Why traditional IAM’s “one principal, one session” model breaks the moment an agent acts as itself, as a user, and as another agent — and what fixes it.

The three eras of engineering what a model sees and what you mean — and exactly where the security boundary lives in each one.

The perceive–plan–act–reflect loop as its own design discipline — termination conditions, runaway-loop failure modes, and the guardrails that keep an agent from looping itself into a bill or a breach.

Why “vibes-based” testing doesn’t scale — golden datasets, LLM-as-judge scoring (and how to attack a judge), and the guardrail stack that turns evals into a production gate.

A working map of the framework layer — orchestration vs. retrieval vs. observability — and the security posture of each, from prompt-injection-via-trace to leaking secrets into an observability backend.

The full guardrail taxonomy — input, output, and the frequently-missed tool-call rails — how the detectors work under the hood, and why a guardrail is a probabilistic filter, not a security boundary.

Why the skill layer sits between the model and MCP tooling and is the least-protected of the three — packaged instructions plus executable code running with the host agent’s full privileges, and the supply-chain controls that close the gap.

Malicious skill packaging, instruction-code smuggling, privilege inheritance from the host agent, and the rest of the skills-specific risk list — each walked through with a working (defanged) malicious skill, an architecture diagram of the blast radius, and the vetting/sandboxing code that stops it.

Two distinct threats hiding under one label — the agent as attack tool, and the compromised enterprise agent as the ransomware vector — anchored in the JADEPUFFER case and closed by least-privilege scoping and immutable backups.

Why a compromised agent is an active participant issuing tool calls at machine speed, not a fixed foothold — and the pre-wired kill-switches and containment hooks that stop it before a human can react.

03 · AI Inference & Production Operations — From Mechanics to the Control Plane

Every AI product is billions of inference calls, not one training run — and once it’s live, running it safely is its own discipline. This section covers both: how inference actually works, and the gateway, pipeline, cost, logging, and observability layers that keep it under control in production.

Everything between “send message” and “receive token” — tokenization, the transformer forward pass, the KV cache, and decoding strategies, with annotated PyTorch.

Why inference is expensive, and the optimization stack — FlashAttention, quantization, speculative decoding, continuous batching — that makes it affordable.

The full serving stack: vLLM, TGI, cloud APIs, edge deployment, cost optimization, and the inference-time security controls that sit alongside all of it.

Why the reverse proxy that centralizes identity, token-denominated cost, and routing is also a crown-jewel target the moment you consolidate all model traffic behind it.

The CI/CD skeleton for shipping models, prompts, and agent configs — where the eval gate replaces the unit-test gate, and the pipeline itself becomes the attack surface.

Denial-of-wallet as the AI-era DoS — inverted attacker economics, and why a cost spike is often the earliest signal that an agent has been hijacked.

Why full prompt/response logs are a new sensitive datastore, not a bigger app log — and how to reconcile forensic reconstruction with GDPR/DPDP erasure.

Tracing, eval telemetry, and drift/behavioral detection as the discipline that catches the quiet attacks — the ones invisible to any single log line.

04 · Responsible AI & Explainability

Security stops the intentional attacks. This pair of series answers the harder question underneath: what does “good” even mean, and how do you prove a model’s decisions are safe and explainable?

Why fairness is a values decision, not a metric, and how the NIST AI RMF turns scattered principles into a working governance spine.

Why safety and security are interdependent but distinct by threat source — and how evals, guardrails, and a written safety case make that distinction operational.

Why accuracy is an engineering claim but explainability is a trust claim — and the regulatory landscape that increasingly demands you can prove the difference.

A practitioner’s tour of SHAP, LIME, counterfactuals, and intrinsically interpretable models, with runnable code and a decision matrix for which tool fits.

Why classical XAI breaks for LLMs, what mechanistic interpretability offers instead, and how explanation becomes an auditable governance artifact.

05 · AI Voice Agents

Voice is agentic AI with a new attack surface bolted on the front — spoofing, deepfakes, and adversarial audio — and a new set of latency and data-residency constraints.

What an AI voice agent is, the technology stack from VAD to TTS, and industry-by-industry use cases from banking to healthcare.

Production-grade architecture, LLM selection and benchmarking for voice, and where audio, transcripts, and PII actually get stored.

Voice spoofing and deepfake fraud, adversarial audio on ASR, and the defensive engineering — anti-spoofing, PII masking, tool-permission models — that stops them.

06 · Data, Model & Infrastructure Security

Below the application layer: the model weights, the training data, the vector store — where an attack leaves no CVE and often no trace on a normal eval.

Why a model can leak training data through ordinary, authorized queries — and the privacy-enhancing technologies (differential privacy, federated learning, SMPC) that actually help.

How ANN indexes work under the hood, why an embedding is not a hash, and the five threats — poisoning, inversion, broken tenancy — that actually bite RAG systems.

Why the model you load is the hard half of your supply chain — poisoned weights, malicious pickles, typosquatted hubs — and the signing and MLBOM controls that gate a safe deploy.

How a base model becomes a product — supervised fine-tuning, parameter-efficient adaptation (LoRA/QLoRA), preference alignment (RLHF/DPO), and the MoE architectures behind today’s frontier models — explained mechanically, with code.

Why reshaping a model’s weights reshapes its threat model — and why a few hundred poisoned samples can implant a backdoor invisible to your standard evals.

The whole picture at once and the feedback loop that keeps it current — plus how the emerging “AI Defense” product category maps onto the six-layer model.

What Secure SDLC is for software, AIPDLC is for AI products — nine phases, a named owner and artifact at each gate, and why Decommissioning is the gate everyone skips.

07 · Industry Playbooks & the Threat Landscape

The horizontal attack catalogue, reframed for the vertical you actually ship in — and a single map of where every AI security control really lives.

The front-door orientation read — the five assumptions AI breaks, and which deep-dive to open next for each of the seven questions leaders actually ask.

Why there is no single AI security framework, and how the seven that matter interlock by altitude and job rather than compete.

Why the same LLM stack carries a different risk profile in fintech, ecommerce, healthcare, and data-heavy SaaS — and which guardrails to prioritize in each.

A CISO’s six-layer map of the AI attack and control surface, from GPU silicon up to deepfakes and disclosure — with the control that belongs at each layer.

Why frontier-scale models carry emergent, hard-to-eval risks that ordinary AppSec review doesn’t catch — dangerous-capability evals, model-weight exfiltration, and the governance controls (RSPs, capability thresholds, staged deployment) that leading labs and regulators are converging on, illustrated with real disclosure timelines.

08 · Building the AI Security Career & Function

For anyone hiring for, staffing, or pivoting into this field — the org-level and career-level guides that sit alongside the technical series.

A hands-on, portfolio-based syllabus to earn the AI Security Architect title — topics, labs, and artifacts, not just a reading list.

Why team size should scale with AI risk surface, not headcount — a resourcing model stress-tested against eight real companies.

A program design — not a reading list — for closing the two-sided AI/security skills gap across a whole team, on a real budget.

The engineer who ships inside the customer’s world — where the role came from, and how AI made it suddenly indispensable.

By Sanjeev Jaiswal · linkedin.com/in/jassics · GenAI Security Series

Also published on medium

Leave a Reply

Discover more from AlienCoders

Subscribe now to keep reading and get access to the full archive.

Continue reading