Advanced Prompt Injection & Jailbreak Resilience

When: Basic concepts Weeks 1--2; RAG/agent variants Weeks 4--6.

• Direct versus indirect prompt injection.

• Multi-turn manipulation, including Crescendo-style gradual context grooming.

• Payload splitting, encoding, and obfuscation (Base64/ROT13) as test cases, not defenses.

• Instruction/data separation, source trust labels, tool authorization independent of model output, least privilege, and human approval.

• Why phrase filters and "ignore previous instructions" blocklists are insufficient.

Practice: build a local adversarial harness against your own app or a local model. Include direct, indirect, multi-turn, split/encoded, and retrieved-document attacks. Measure unauthorized tool invocation, cross-user/tenant data exposure, unapproved side effects, benign task success, false-positive blocking, latency, and cost.

Only test your own local app, authorized labs, or systems where you have explicit permission. Do not attempt to bypass a commercial LLM's system prompt or attack third-party services. A model's refusal behavior is not the same as application security.

Do not learn yet: an elaborate autonomous jailbreak agent or the idea that a model can be made "unjailbreakable." The goal is to constrain impact even when the model is manipulated.