Compendium › Learning Paths › Defense Fundamentals

Defense Fundamentals

Intermediate 3 Labs 5 Lessons ~3-4 hours hands-on

The best defense is understanding the offense. This path teaches you how prompt injection attacks work so you can design AI systems that resist them. Input sanitization, output filtering, confirmation gates, monitoring, and architectural hardening — all grounded in the attack patterns you can practice in the labs.

Path Overview

Defense against prompt injection requires a different mindset than traditional security. You can't just sanitize input — the input IS the instruction. This path teaches you to think like an attacker so you can build systems that anticipate and resist manipulation. We recommend completing at least one of the offensive paths first so you can recognize the attack patterns these defenses are designed to stop.

Defensive Approach

Each defense lesson in this path references a specific attack pattern. Read the defense alongside the corresponding offensive technique so you can see the attack in action and understand exactly what the defense prevents — and what it doesn't.

Labs in This Path

These are the labs where the attacks defended in this path actually work. Practice the attack, then return to study the defense.

Blind XSS Through LLM

4 Levels

Support ticket triage AI that renders HTML when analysts review summaries. The attack chain this enables — indirect injection plus output rendering — is exactly what the output-handling defense lessons target.

Defended by: Improper Output Handling, Confirmation Gates.

Launch Lab →

Blind SSRF Through LLM

4 Levels

Research assistant fetching URLs from an internal corpus. The attack here bypasses input validation by exploiting the AI's tool-calling authority — directly relevant to the tool-calling security and confirmation gates defenses.

Defended by: Tool Calling Best Practices, Confirmation Gates.

Launch Lab →

BingBong

5 Levels

System prompt extraction through direct asks and bait-and-switch. The defense lessons on FIDS and prompt-drift detection are designed to catch exactly this kind of leak.

Defended by: FIDS, Prompt Drift Detection, Sensitive Information Disclosure.

Launch Lab →

Lessons in This Path

Five core defense lessons. Each one is grounded in a specific attack pattern.

1

FIDS: Foreign Instruction Detection Through Separation

Training-time defenses for document pipelines that keep user content from being interpreted as instructions.

BingBong 2

Confirmation Gates and Constrained Actions

Limiting agent risk through system controls — how to make dangerous actions require explicit human approval.

XSS Lab 3

Improper Output Handling: Validating LLM Outputs

Checking AI output for signs of compromise before rendering or executing — the defense against the XSS lab.

XSS Lab 4

Tool Calling and Agent Security Best Practices

How to design agent tool access so the SSRF-style attacks can't reach internal services.

SSRF Lab 5

Intent Security and Behavioral Monitoring for AI Agents

Observability patterns for detecting prompt injection attempts and unusual agent behavior in production.

All Labs

What You'll Learn

  • How to separate instructions from data in AI pipelines (FIDS)
  • Confirmation gates that limit blast radius when an agent is compromised
  • Output validation patterns that catch XSS-style exfiltration before rendering
  • Tool-calling restrictions that block SSRF chains
  • Behavioral monitoring signals for detecting attacks in production
  • How to think about defense-in-depth when AI is in the loop

The 5 lessons above are the core path. For deeper coverage, see the full Defense Lessons collection (25 lessons). The taxonomy-curation skill maintains a separate defense strategy overview for the bigger picture.

Next Steps

After completing this path, revisit the offensive paths with a defensive mindset:

Prompt Injection 101 Beginner · 3 Labs · 4 Lessons AI Bugs Puncturing the Web Intermediate · 2 Labs · 5 Lessons Indirect Injection Mastery Advanced · 3 Labs · 4 Lessons Real-World AI Exploitation Intermediate · 3 Labs · 4 Lessons