LatentLens · Security

Security begins with the system, not the prompt.

Understand the system, find the assumption that breaks, design the defense, and retest. Levels 7 to 10 of the curriculum, built on the mechanisms in Mastery (levels 1, 4 and 5 are the prerequisites).

Foundations first

The words a security engineer uses, each mapped to what it means in an LLM application.

Asset
Something of value that must be protected.
In an LLM system: Customer data, secrets, the ability to send email as the user, money, model weights, availability and cost.
Adversary
Someone with goals against your assets, and some capability.
In an LLM system: A malicious user, the author of a document or web page the system reads, the operator of a connected tool server.
Trust boundary
A place where data or control crosses between different levels of trust.
In an LLM system: Retrieved text entering the prompt; model output becoming a tool call; tool output re-entering the context.
Attack surface
Every way an adversary can reach the system.
In an LLM system: Chat input, uploads, retrieved documents, emails, images, tool results, memory, tool descriptions.
Threat
A possible way an adversary could cause harm.
In an LLM system: Untrusted document text causing an unauthorized email.
Vulnerability
A weakness that makes a threat possible.
In an LLM system: The email tool accepts any recipient the model writes.
Impact
The harm if the threat succeeds.
In an LLM system: Private data sent to an outside address.
Risk
Likelihood combined with impact.
In an LLM system: High if the agent reads public content and holds broad permissions.
Control
A measure that reduces likelihood or impact.
In an LLM system: Recipient allowlist plus human approval before sending.
Confidentiality, integrity, availability
No unauthorized disclosure; no unauthorized modification; the service stays usable.
In an LLM system: Leaked context; manipulated answers or actions; runaway cost and loops.
Authentication vs authorization
Who you are vs what you may do.
In an LLM system: Logging in does not authorize every action an agent proposes on your behalf.
Least privilege
Grant only what the task needs.
In an LLM system: A calendar assistant gets a read-only calendar credential and nothing else.
Defense in depth
Several independent controls, so one failure is not a breach.
In an LLM system: Classifier, plus permissions, plus approval, plus logging.
Sandboxing
Run risky operations where they cannot harm the real system.
In an LLM system: Generated code runs in a container with no secrets and no network.
Validation
Check inputs and outputs against what is allowed.
In an LLM system: Tool arguments parsed against a schema; output escaped before rendering.
Monitoring and incident response
Notice misuse and act on it.
In an LLM system: Audit logs of prompts, tool calls and approvals; alerts; a kill switch.

Two principles to keep

The model proposes. The system authorizes.

An LLM's output is text. When that text names an action, the application decides whether it happens, using permissions, validation and approvals that exist outside the probabilistic model. Natural-language output is never itself authorization.

Security does not mean truthfulness.

Architecture-level controls can reduce data exposure, unauthorized actions, privilege abuse and blast radius. They cannot guarantee factual correctness, correct reasoning or the absence of hallucination. A planted false claim needs no privileges, so capability controls cannot stop it; that needs verification, grounding and human review.

The path

  1. 7
    AI security foundations
    Assets, boundaries, threat models · after level 5
    0/4 mastered · not started
    1. 7.1 Security foundations, mapped to LLM systemsNot started
    2. 7.2 Web security basics every AI engineer needsNot started
    3. 7.3 Threat modeling an AI applicationNot started
    4. 7.4 Model, application, infrastructure, peopleNot started
  2. 8
    LLM application security
    Injection, leakage, poisoning, output handling · after level 7
    0/9 mastered · not started
  3. 9
    Agentic AI security
    Bound what any decision can do · after level 8
    0/3 mastered · not started
  4. 10
    AI red teaming and defense
    Test, measure, fix, retest · after level 9
    0/2 mastered · not started

More

LabsLocal, simulated labs with fixed synthetic fixtures: system, trust boundary, failure, root cause, defense, retest, residual risk.FrameworksOWASP, NIST, MITRE ATLAS, SAIF and the MCP specification, with editions, verification dates and mapped topics.Follow one request: security viewEvery trust boundary in a real email-assistant request.