Your route
From zero to red team, one step at a time.
Topics count as done when the review system rates them mastered (answered right on three spaced reviews). Everything else (a module, a Build step passing its checks on your machine, a lab) you mark yourself. All of it is stored only in this browser.
Overall0 / 89
- 00 / 9Foundations
Vectors, matrices, probability, gradients, backprop, next-token prediction.
- 10 / 4The Atlas
The whole transformer, drawn and explained part by part with Qwen3-8B's real numbers.
- 20 / 8Build it
Write autograd, a tokenizer, attention and a tiny Qwen-style GPT yourself, with automatic checks.
- Step 1: Autograd from scratch (checks pass)
- Step 2: A counting language model (checks pass)
- Step 3: A byte-level BPE tokenizer (checks pass)
- Step 4: Attention by hand (checks pass)
- Step 5: RMSNorm, RoPE, SwiGLU (checks pass)
- Step 6: A tiny Qwen-style GPT (checks pass)
- Step 7: Sampling and the KV cache (checks pass)
- Step 8: LoRA fine-tuning (checks pass)
- 30 / 34Mastery
Training, post-training, inference and serving, RAG, agents and MCP, interpretability.
- Autoregressive language modeling
- Tokenization
- Embeddings
- The residual stream
- RMSNorm (and Q/K norm)
- Linear projections (xW)
- Queries, keys and values
- MHA, MQA and GQA
- RoPE: rotary position embedding
- Causal attention, end to end
- The MLP (SwiGLU)
- Residual connections and depth
- Final norm and LM head
- Softmax and decoding
- Pretraining data: from the web to token sequences
- One training step: loss, backprop, optimizer
- Scaling laws and compute-optimal training
- Evaluating LLMs: loss, benchmarks, contamination, LLM judges
- Scaling: distributed training, checkpoints, evaluation
- Post-training: SFT, reward models, RLHF, DPO
- Fine-tuning in practice: full, LoRA, QLoRA
- Reasoning models: chain of thought, RL with verifiable rewards, test-time compute
- Modern architectures: dense, MoE, long context, multimodal
- Inference: prefill, KV cache, decode
- Serving systems: batching, paged attention, prefix caching
- Efficiency: FlashAttention, quantization, speculative decoding
- Retrieval-augmented generation
- Hallucination, calibration and grounding
- Agents and tool calling
- Agent memory, state and multi-agent systems
- MCP: the Model Context Protocol
- Hidden states and linear probes
- Logit lens, attribution and causal methods
- Features, superposition and sparse autoencoders
- 40 / 18AI security
Threat models, prompt injection, jailbreaks, poisoning, extraction, agent and MCP security.
- Security foundations, mapped to LLM systems
- Web security basics every AI engineer needs
- Threat modeling an AI application
- Model, application, infrastructure, people
- Prompt injection, direct and indirect
- Jailbreaks, adversarial inputs and guardrails
- Sensitive information disclosure and privacy attacks
- Data poisoning, model poisoning and backdoors
- Model extraction and model theft
- RAG security: poisoned, leaked and cross-tenant retrieval
- Improper output handling
- Unbounded consumption and denial of wallet
- AI supply chain
- Agentic AI security (OWASP Agentic Top 10)
- Memory and context poisoning
- MCP security
- How an AI red team thinks
- Defense in depth for LLM systems
- 50 / 16Practice
Labs, security labs and red-team exercises against real targets.
- Security lab 1: Trust boundaries
- Security lab 2: Web bugs LLM apps inherit
- Security lab 3: Prompt injection, direct and indirect
- Security lab 4: Secrets and system-prompt leakage
- Security lab 5: Excessive agency and blast radius
- Security lab 6: Memory poisoning across sessions
- Security lab 7: Poisoned and leaky retrieval
- Security lab 8: Improper output handling
- Security lab 9: Unbounded consumption
- Security lab 10: Measure it: the red-team eval suite
- Lab: RMSNorm versus LayerNorm
- Lab: Attention microscope
- Lab: Position and RoPE
- Lab: Temperature and sampling
- Lab: KV cache
- Lab: One training step
not startedlearningdue for reviewmastered