Skip to Content
View all events

Agentic AI Security Bootcamp

Published by Pearson

Intermediate to advanced content levelIntermediate to advanced

Secure the full lifecycle of agentic AI systems—from data pipelines to decentralised agents

  • Master observability, infrastructure defense, and red teaming across the entire AI lifecycle—from data ingestion to multi-agent coordination.
  • Go beyond theory with hands-on red teaming of distributed intelligent systems using modern adversarial techniques.
  • Gain cross-functional skills at the intersection of AI engineering, red teaming, and security architecture.

As autonomous and semi-autonomous agents become central to AI deployments, securing the infrastructure that enables agentic AI is now a critical technical challenge. This four-part live training series provides hands-on instruction in identifying, testing, and mitigating vulnerabilities across the full AI trust stack, with a specific focus on the coordination, inference, and behaviour of distributed intelligent agents.

Led by Dr Petar Radanliev, an expert in adversarial AI and red teaming of decentralised systems, this course explores how agentic AI introduces distinct attack surfaces, ranging from reward shaping and agent policy drift to compromised communication protocols and poisoned coordination graphs. You will gain practical expertise in modelling, penetrating, and hardening agentic AI architectures, using a combination of modern threat intelligence, observability engineering, and simulated red team exercises.

Week 1: AI Model Observability and Evaluation of Agentic AI Risks

Analyse how telemetry, explainability, and evaluation frameworks apply to agentic systems. Learn how attackers exploit limited observability in agent environments to bypass detection and influence agent behaviour.

Week 2: Securing AI from the Data Layer Up to the Agentic Layer

Explore how corrupted data and poisoned transformation workflows propagate into agent environments. Develop layered defences that preserve agent integrity, reasoning transparency, and coordination stability.

Week 3: AI Architecture and Agentic AI Infrastructure

Red team the architectural foundations that enable distributed agent deployment, including insecure orchestration, model registries, and multi-agent inference environments.

Week 4: Red Teaming Multi-Agent AI Systems

Penetrate agent ecosystems by simulating reward manipulation, belief poisoning, rogue agent injection, and emergent coordination breakdowns. Build defences to restore system resilience under adversarial pressure.

What you’ll learn and how you can apply it

Week 1: AI Model Observability and Evaluation

  • Monitor AI models and pipelines to detect adversarial attacks like data poisoning and prompt injection in real time.
  • Conduct forensic analysis on model logs to uncover hidden threats and anomalies.
  • Build adversarial testing frameworks to simulate and defend against penetration attacks.
  • Integrate model observability into red teaming workflows to measure exposure, trace attacker movement, and validate AI defenses.

Week 2: Securing AI from the Data Layer Up

  • Identify and secure high-risk points across the entire AI data pipeline, from ingestion to feature stores.
  • Simulate realistic data poisoning and subversion attacks with red teaming exercises.
  • Implement access controls, anomaly detection, and secure versioning to protect AI data workflows.
  • Communicate data security risks effectively across teams to ensure holistic AI protection.

Week 3: AI Architecture/Infrastructure

  • Build threat models and attack graphs to identify critical vulnerabilities in AI data pipelines, orchestration layers, and model-serving components.
  • Simulate multi-stage attacks including poisoned data and insecure deployment environments.
  • Apply DevSecOps best practices such as secure container orchestration and role-based access control.
  • Design tailored security controls to strengthen AI system defenses.

Week 4: Red Teaming Multi-Agent AI Systems

  • Design and execute red teaming operations against multi-agent systems using tools such as PettingZoo and MARLlib.
  • Identify and exploit key vulnerabilities in MAS environments, including belief poisoning, reward manipulation, and agent impersonation.
  • Develop and deploy threat models and penetration testing workflows for systems such as autonomous swarms and distributed sensor networks.
  • Build robust defensive strategies using adversarial reinforcement learning, trust-aware controls, and anomaly detection in agent communications.

This live event is for you because...

  • You are a cybersecurity expert or red teamer looking to uncover how attackers target AI models and infrastructure.
  • You are an AI or MLOps engineer deploying models and need to secure pipelines, APIs, and data workflows.
  • You are in DevSecOps or platform engineering and want to integrate threat detection and access control into AI systems.
  • You are an enterprise architect building AI platforms and need to defend against data poisoning and supply chain attacks.

Prerequisites

  • Basic understanding of technology or IT systems
  • Interest in AI infrastructure or security topics
  • A computer with a stable internet connection for hands-on exercises

Course Set-up

Recommended Preparation

Recommended Follow-up

Schedule

The time frames are only estimates and may vary according to how the class is progressing.

Week 1: AI Model Observability and Evaluation

Session 1: Foundations of AI Model Observability and Attack Surfaces (50 mins)

  • Overview of AI observability stacks: metrics, logs, traces, and outputs
  • Security role of observability and real-world attack blind spots
  • Case study: Stealth perturbation attacks and model introspection risks
  • Practical: Deconstruct a vulnerable model pipeline; instrument minimal observability; identify blind spots

Break + Q&A (10 mins)

Session 2: Attacking Evaluation Metrics and Monitoring Weaknesses (50 mins)

  • Adversarial tactics targeting metric fragility and static evaluation pitfalls
  • Case study: Model inversion attack exploiting logging gaps
  • Practical: Deploy evaluation dashboard; simulate metric manipulation attack; analyze telemetry gaps

Break + Q&A (10 mins)

Session 3: Red Teaming AI Observability and Telemetry-Aware Attacks (50 mins)

  • Reconnaissance and evasion techniques targeting observability hooks
  • Threat modelling linking anomalies to attacker goals
  • Tools: Distributed tracing, explainability as audit trail
  • Practical: Design telemetry-aware pen test; inject adversarial examples; build trace correlation

Break + Q&A (10 mins)

Session 4: Defensive Observability and Adversarial Evaluation Pipelines (50 mins)

  • Securing observability: robust logging, tamper-evidence, drift monitoring
  • Building resilient evaluation pipelines with attack simulation and feedback loops
  • Case study: Hardened LLM with prompt injection detection and rollback
  • Practical: Implement observability hooks for anomaly detection; deploy adversarial evaluation harness

Q&A (10 mins)

Week 2: Securing AI from the Data Layer Up

Session 1: Mapping the Attack Surface (50 mins)

  • Overview of modern AI data stacks: ingestion (Fivetran, Kafka), transformation (dbt), storage (Snowflake, BigQuery), orchestration (Airflow), and feature stores (Feast)
  • Threat modeling: unvalidated data, logic drift, insecure APIs, poisoned pipelines
  • Case study: Upstream logic poisoning leading to corrupted model predictions
  • Practical: Visualize stack flow (Airbyte + dbt + Postgres + Feast); identify insecure components; map entry points and exfiltration paths

Break + Q&A (10 mins)

Session 2: Exploiting the Data Layer (50 mins)

  • Data poisoning techniques: label flipping, feature drift, backdoors via structured inputs
  • Exploiting transformation layers: SQL logic bombs, bias injection
  • Attacking feature stores: tampering with derived values and time-sensitive features
  • Case study: Model skew caused by attacker-controlled data streams
  • Practical: Simulate poisoning via ingestion tool; inject logic bias via dbt; insert delayed triggers in feature store

Break + Q&A (10 mins)

Session 3: Red Teaming the Data Stack (50 mins)

  • Red team techniques: API fuzzing, DAG hijacking, impersonating data sources
  • Weak separation of duties in shared environments
  • Case study: Orchestration-layer compromise injecting tainted training data
  • Practical: Compromise Airflow DAG; spoof Kafka input; extract logs and metadata to reveal model exposure

Break + Q&A (10 mins)

Session 4: Hardening and Governance (50 mins)

  • Securing pipelines: validation with Great Expectations, role-based access, versioned feature workflows
  • Monitoring and governance: anomaly detection, retraining thresholds, compliance integration--- Case study: Containment and recovery after transformation-layer poisoning
  • Practical: Implement input validation; monitor feature drift; configure access policies for transformation and feature stores

Q&A (10 mins)

Week 3: AI Architecture/Infrastructure

Session 1: Understanding the AI Infrastructure Stack and Its Vulnerabilities (50 mins)

  • Overview of AI infrastructure components: data pipelines, feature stores, model registries, training clusters, inference APIs
  • Architectural risk points: insecure orchestration (e.g., Kubernetes), misconfigured CI/CD, multi-tenant GPU resource risks
  • Case study: Exploitation of MLflow model registry to exfiltrate poisoned artefacts
  • Practical: Visualize an open-source MLOps stack; identify access misconfigurations, unencrypted data paths, unauthenticated endpoints; begin building an attack graph

Break + Q&A (10 mins)

Session 2: Building Attack Graphs for AI Infrastructure Exploitation (50 mins)

  • Principles of AI attack graph construction: nodes, privilege escalation, lateral movement
  • Tactics, techniques, and procedures (TTPs): model exfiltration, training job poisoning, GPU container attacks
  • Case study: Full-chain compromise from poisoned data to corrupted inference logic
  • Practical: Build attack graph for poisoned training dataset leading to backdoored model; map attack chain and identify architectural weaknesses

Break + Q&A (10 mins)

Session 3: Infrastructure-Level Red Teaming: Exploiting the AI Stack (50 mins)

  • Red teaming objectives and constraints targeting AI infrastructure
  • Exploitation techniques: hijacking CI/CD model promotion, container persistence, telemetry abuse
  • Case study: Inference API abuse to extract model logic via output pattern mining
  • Practical: Simulate inference API exploitation; deploy tainted model via registry abuse; perform container breakout from GPU inference pod

Break + Q&A (10 mins)

Session 4: Securing AI Infrastructure and Mitigating Architectural Risk (50 mins)

  • Defensive architecture: role-based access control, cryptographic signing, rate limiting, input validation
  • Securing ML CI/CD: signed pipelines, container hardening, isolated environments
  • Supply chain defense: model verification, dependency provenance, allowlisting
  • Case study: Remediation after AI pipeline backdoor incident
  • Practical: Deploy hardened AI infrastructure; integrate model provenance and signing; simulate adversarial deployment and apply mitigations

Q&A (10 mins)

Week 4: Red Teaming Multi-Agent AI Systems

Session 1: Introduction to Multi-Agent Systems and Red Teaming (50 mins)

  • Overview of multi-agent architecture, decentralised coordination, and communication protocols
  • MAS attack surfaces: messaging, consensus, reward propagation, belief sharing
  • Red teaming goals: destabilisation, coordination failure, emergent pattern manipulation
  • Case study: Sensor spoofing in swarm robotics
  • Practical: Threat mapping on communication topologies with PettingZoo/MARLlib; simulate injection points in MAS

Break + Q&A (10 mins)

Session 2: Adversarial Attack Vectors in MAS & Failure Propagation (50 mins)

  • Attack types: agent impersonation, reward manipulation, belief poisoning, message interference
  • Failure propagation dynamics in negotiation, consensus, task allocation
  • Case study: Cascading disruption in drone swarms
  • Practical: Simulate malicious agent affecting collective learning; visualize failure propagation with NetworkX and Gymnasium

Break + Q&A (10 mins)

Session 3: Red Teaming Methodologies & MAS Penetration Testing (50 mins)

  • Red teaming workflows adapted for MAS: reconnaissance, infiltration, execution, escalation
  • Adversarial RL and security frameworks (STRIDE, MITRE ATLAS)
  • Ethics and constraints in MAS attack simulation
  • Practical: Pen-test by injecting altered policies and adversarial agents; robustness assessment via stress tests

Break + Q&A (10 mins)

Session 4: Defensive Strategies & Secure MAS Design (50 mins)

  • Defensive tactics: trust-aware routing, quorum control, adversarial training, anomaly detection
  • Emerging threats: self-replicating agents, rogue collectives, coordinated deception
  • Case study: Threat isolation in autonomous logistics
  • Practical: Build resilience layer; red team vs blue team simulation; evaluate coordination recovery and communication integrity

Q&A (10 mins)

Your Instructor

Dr. Petar Radanliev

Dr. Petar Radanliev lectures and supervises postgraduate master’s students’ research dissertations on AI and cybersecurity at the Department of Computer Science, University of Oxford. He is also a Lecturer/Instructor at Pearson and O’Reilly (USA), while conducting research on digital identity system security at the Alan Turing Institute, based at the British Library in London. After completing his PhD in 2013/14, Petar held postdoctoral research appointments at Imperial College London, the University of Cambridge, the Massachusetts Institute of Technology, and the Department of Engineering Science at the University of Oxford, where he remained for seven years before moving to his current position. His work spans artificial intelligence, cybersecurity, post-quantum security, and blockchain security. This research has led to an H-index of 25 (as indexed by Web of Science and Scopus), over 3,700 citations, more than 100 peer-reviewed publications, and four authored books. In recognition of his contributions, Petar has received major funding awards, including a Fulbright Fellowship and the Prince of Wales Innovation Award.

Skill covered

AI Security