Defending AI systems requires a defense-in-depth strategy — multiple layers of protection so that if one fails, others catch the attack. No single technique is sufficient.

The Defense-in-Depth Framework

Layer 1: Input Defenses

• Content filtering — Block known attack patterns (prompt injection signatures, encoded payloads)
• Input validation — Reject inputs that exceed length limits, contain suspicious characters, or match attack templates
• Canary tokens — Include hidden markers in system prompts; if they appear in output, injection is occurring
• Rate limiting — Prevent brute-force prompt injection attempts

Layer 2: Model-Level Defenses

• Instruction hierarchy — Train models to prioritize system-level instructions over user inputs
• Constitutional AI — Models trained to follow ethical principles and refuse harmful requests
• Fine-tuning for robustness — Additional training on adversarial examples
• Model distillation — Smaller, more predictable models for security-critical applications

Layer 3: Output Defenses

• Output filtering — Scan responses for policy violations, PII leakage, or harmful content
• Secondary classifier — A separate model evaluates whether the primary model's output is safe
• Structured output — Constrain outputs to specific formats (JSON, multiple choice) to prevent free-text attacks
• Confidence thresholds — Flag low-confidence outputs for human review

Layer 4: System-Level Defenses

• Audit logging — Record all inputs, outputs, and actions for forensic analysis
• Anomaly detection — Monitor for unusual patterns in usage, outputs, or tool calls
• Circuit breakers — Automatically disable features when attack indicators are detected
• Incident response — Have a plan for when (not if) attacks succeed

Red Teaming in Practice

How to red team your own AI system:

1. Define scope — What are you testing? Chatbot, agent, API, entire pipeline?
2. Enumerate attack surfaces — Where does untrusted input enter the system?
3. Develop test cases — Create a library of attacks: prompt injection, jailbreaks, adversarial inputs
4. Execute systematically — Test each attack surface with each test case
5. Document findings — Severity, reproducibility, and recommended fixes
6. Fix and retest — Implement defenses and verify they work against the original attacks

Building a Security Culture

• Treat AI security as ongoing, not one-time
• Share findings across teams and with the AI security community
• Stay current with new attack techniques (they evolve weekly)
• Budget for regular red team exercises
• Consider bug bounty programs for AI-specific vulnerabilities

Congratulations on completing AI Security & Red Teaming! You now understand both how AI systems can be attacked and how to defend them. Stay vigilant — the threat landscape evolves as fast as the technology. 🛡️