Applied AI Security Certificate Program (Self-Paced)
IDCYSE.AAICP.SP

Self-paced online training with expert support Certificate with 3 courses

Three self-paced courses across the life of an AI system — securing it before it ships, watching it once it is live, then attacking it on purpose and documenting why it can be trusted.

$2,299 32 clock hours Live Support Start anytime

This program includes

  • 32 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Verified digital certificate of completion
  • Learn at an accredited institution

This is the self-paced version. For live instruction, enroll in Applied AI Security Certificate Program.

An AI system fails in ways an ordinary system cannot. It can be poisoned before it is ever trained, fooled after it is deployed, or talked into leaking its own data. This self-paced path treats AI as engineering rather than policy, working across the data, the model, the pipeline and the application. It starts by separating traditional cybersecurity risk from risk that is genuinely specific to AI, then follows the lifecycle from design through retirement with security gates along the way. Adversarial machine learning is the technical core — poisoning against training data, evasion against deployed models, privacy attacks aimed at training information, and model extraction — anchored to the NIST adversarial machine learning taxonomy. Generative AI is treated in its own right rather than as a footnote, covering direct and indirect prompt injection, insecure output handling, and what retrieval-augmented generation, plugins and external data sources introduce.

From there the path answers a harder question: how would you know? An AI system can be compromised without anyone touching the server it runs on, which means monitoring has to shift from whether the system is up to whether it is behaving as intended, on data it was meant to see, for purposes it was approved for. You work the four categories of AI monitoring and learn to read the signals apart — a sustained run of near-identical odd inputs looks like adversarial probing, a gradual accuracy decline looks like drift, an unexplained query spike from a single credential looks like extraction — and you learn what responders habitually lose: the model version in use, the surrounding prompt and response logs, training data lineage, the guardrail configuration in force. Severity is judged by impact on safety, rights and mission rather than by technical difficulty, on the reasoning that a wrong benefits determination caused by a data integrity failure is severe even though nothing broke. The path then pulls apart two ideas agencies routinely merge: red teaming is deliberately trying to break, mislead or misuse a system, while assurance is the documented evidence that it is trustworthy enough for its purpose. You run the engagement lifecycle, write rules of engagement — the thing that separates an exercise from an incident — and build an assurance case as claim, argument and evidence, in a shape an oversight body can audit, closing on foundation models and agentic AI, where the attack surface widens from what a system says to what a system does.

Read more

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 12 Hours

Securing AI/ML Systems: Protecting the Intelligent Attack Surface Course (Self-Paced)

Engineering-tier AI and machine learning security spanning data, model, pipeline and application, built around adversarial machine learning and generative AI risk.

  • AI/ML system architecture, with models, datasets, pipelines, applications and infrastructure distinguished
  • AI-specific security risk separated from traditional cybersecurity risk
  • Security mapped across the AI lifecycle from design to retirement
  • Protecting confidentiality, integrity, availability and provenance of training and operational data
  • Data poisoning and manipulation risks in collection, labeling and preprocessing
  • Poisoning, evasion, privacy and model-extraction attacks, and defenses that increase robustness
  • Models, weights and checkpoints as protected assets, with provenance verified before deployment
  • Third-party models, datasets, libraries and frameworks assessed as supply-chain dependencies
  • Direct and indirect prompt injection, insecure output handling, and retrieval-augmented generation risk
  • Security for ML pipelines, orchestration platforms, APIs and deployment
  • Detecting abnormal inputs, outputs and model behavior versus performance degradation
  • AI-specific incident response: containment, model rollback and post-incident validation

Unit 2 12 Hours

AI Red Teaming and Assurance Course (Self-Paced)

An advanced course and the capstone of the applied AI security path, covering adversarial testing of AI systems and the assurance evidence that justifies running them.

  • Red teaming distinguished from adjacent assurance activities and placed in the assurance lifecycle
  • The red-team engagement lifecycle from planning through reporting
  • Scoping to risk classification and setting usable objectives
  • Rules of engagement, team composition and deconfliction
  • Matching adversarial testing techniques to attack surfaces
  • Manual expert-driven testing weighed against automated approaches
  • Probing techniques for generative AI systems
  • Telling a red-team finding apart from an ordinary software bug
  • TEVV records that support a risk decision
  • The assurance case as claim, argument and evidence
  • Model cards, system cards and independent evaluation
  • Findings reports prioritized by impact rather than technical complexity
  • Remediation, retesting and human oversight as a mitigation
  • Recognizing when a finding becomes an incident
  • Testing and assurance for foundation models and agentic, tool-using systems

Unit 3 8 Hours

AI Security Monitoring and Incident Response Course (Self-Paced)

Practitioner-level AI security monitoring and incident response, covering what to watch, how to tell an incident from a blip, and what to do in the first hour.

  • How AI security risks differ from and compound traditional IT risks
  • The vocabulary of AI incidents: data poisoning, adversarial examples, prompt injection, drift, extraction
  • Continuous monitoring for a high-impact AI system, beyond uptime and throughput
  • The four monitoring categories and the technique that fits each
  • Risk-based security event logging for AI systems
  • Reading monitoring signals and identifying likely causes
  • Telling anomalies apart from genuine AI security incidents
  • Preserving AI-specific evidence: model version, prompt and response logs, data lineage
  • Classifying severity by impact on safety, rights, mission and data
  • The four-phase incident response lifecycle applied to AI
  • AI-specific containment, including model rollback and disabling automated decisioning
  • Root cause analysis and revalidation before return to automated operation
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts