GuildCyber
Proof of Skill
Curriculum Outline · v1

The Guild Cyber curriculum

Five tracks, built backward from real AI security job postings. Every module ends in something you can show a hiring manager, not just a box you ticked.

Wedge
Offensive AI security
Tracks
Offense · Defense · Governance · Adversarial ML · Supply Chain
Frameworks
OWASP LLM Top 10 · MITRE ATLAS · NIST AI RMF
Proof
A portfolio artifact per module

This outline turns the five-track model into concrete modules. Each module is anchored to a skill that shows up repeatedly in real offense, defense, and detection job descriptions, and each one produces a demonstrable artifact: a solved challenge, a tool campaign, a hardened app, or a framework-aligned report. Content is deliberately not the moat, since everyone teaches the same frameworks. The moat is rigor, reputation, and results a candidate can point to.

We lead with Offense because it is the newest role, has the lowest barrier to entry, and is the easiest to show off. Defense, Governance, Adversarial ML, and Supply Chain are mapped here so the full path is visible, and so the government and defense audience can see where the procurement-recognized language lives.

1

Backward from job postings

Modules are reverse-engineered from the skills and named tools that recur across real AI security listings, so learning maps directly to hiring.

2

Every module earns proof

You finish a module by producing an artifact: a challenge solve, a testing campaign, a defended app, or a report. That artifact is the credential.

3

Marks stack toward the Seal

Guild Marks accrue as you go. Mastering a track opens the door to the flagship Guild Seal, the proctored credential that carries real weight.

How credentials map to the curriculum

Guild Marks (per module)
Free, shareable micro-credentials. One per module, tiered Apprentice through Guildmaster. This is the on-ramp.
The Guild Seal (per track)
The flagship. A proctored, practical, low-pass-rate exam taken after a track's capstone. Separate name, difficulty, and process, on purpose.
Live
Track 1

Offense · AI Red Team

Hiring function: AI Red Teamer, Adversarial ML Tester, LLM Penetration Tester. The roles where a public CTF ranking outweighs years on a resume.
1

How language models fail

Apprentice
The threat model for LLM systems. Where inputs become instructions, where trust boundaries blur, and how attackers think about a model's attack surface. Orientation to the two frameworks everyone standardizes on.
Maps to: "familiarity with OWASP LLM Top 10 and MITRE ATLAS," a near-universal line in offense listings.
Frameworks & tools
OWASP LLM Top 10MITRE ATLAS
Demonstrable artifact
Attack-surface map of a sample LLM app, annotated to OWASP and ATLAS entries.
2

Direct prompt injection

Apprentice
Instruction override and system-prompt extraction against naive assistants. The foundational move: making the most recent instruction win. This is the viral first-win everyone can get in a browser.
Maps to: "prompt injection testing," the single most common offense skill listed.
Frameworks & tools
Manual injectionGarak (intro)
Demonstrable artifact
Solved challenge: extract a hidden system prompt (the Steward, the first target on the challenges page).
3

Jailbreaking and guardrail bypass

Journeyman
Getting past a model that refuses the obvious ask. Roleplay and fiction framing, encoding and obfuscation, many-shot and context manipulation. Learning why a guardrail that stops the direct request still leaks under indirection.
Maps to: "jailbreak research," "adversarial robustness testing."
Frameworks & tools
Garak probesJailbreak taxonomies
Demonstrable artifact
Solved challenge: defeat a hardened assistant with indirection (the SENTRA challenge).
4

Indirect injection and agent misuse

Master
The frontier class. When a model reads untrusted content (a document, a web page, a tool result) and treats that data as commands. Exfiltration through agents and RAG pipelines, tool hijacking, and data-as-command attacks.
Maps to: "agentic AI security," "RAG security," "tool/agent misuse," the fastest-growing offense requirements.
Frameworks & tools
Agent frameworksRAG poisoningMITRE ATLAS
Demonstrable artifact
Solved challenge: exfiltrate an agent's secret via indirect injection (the ATLAS challenge).
5

Automated adversarial testing

Master
Scaling from one-off tricks to a repeatable testing practice. Building and running attack suites, scoring outputs, and producing the kind of coverage a real engagement needs. This is where the named tools in job descriptions become hands-on skills.
Maps to: "experience with Garak and PyRIT," the two adversarial-testing frameworks named directly in postings.
Frameworks & tools
PyRITGarakCustom probes
Demonstrable artifact
Testing campaign: run a PyRIT/Garak suite against a target and publish a findings report.
6

Capstone: live red-team engagement

Guildmaster
No script. Jailbreak an actual model with your own tooling, then write it up like a professional. This is the live-model target on the challenges page paired with a real red-team report. Clearing it reaches Guildmaster and opens the door to the Guild Seal.
Maps to: a portfolio a hiring manager can read in seconds: a real solve plus a professional writeup.
Frameworks & tools
Live modelRed-team reporting
Demonstrable artifact
Live jailbreak + report, and eligibility for the Offense Guild Seal.
Live
Track 2

Defense · LLM Security Engineering

Hiring function: LLM Security Engineer, AI Application Security, ML Platform Security. The blue-team counterpart to every offense skill.
1

Secure prompt and system design

Apprentice
Defensive prompting done properly. Instruction hierarchy, clear trust boundaries, and why "just tell the model not to" is not a control. Designing systems that fail closed.
Maps to: "secure LLM application design," "prompt hardening."
Frameworks & tools
OWASP LLM Top 10Instruction hierarchy
Demonstrable artifact
Design review: rewrite a weak system design and document the trust boundaries.
2

Input and output guardrails

Journeyman
Detecting and blocking injection at the boundary. Classifiers, filters, canary tokens, and output validation. Building guardrails that catch the attacks from the Offense track without breaking normal use.
Maps to: "guardrail implementation," "content filtering," "abuse prevention."
Frameworks & tools
Guardrail frameworksCanary tokens
Demonstrable artifact
Working guardrail that blocks a set of known injection payloads, with a pass/fail report.
3

Securing RAG and the data layer

Journeyman
Treating retrieved content as untrusted. Source validation, retrieval trust boundaries, and defending against data poisoning so a malicious document cannot steer the model.
Maps to: "RAG security," "data poisoning defense," "vector store security."
Frameworks & tools
RAG pipelinesProvenance
Demonstrable artifact
Hardened RAG build: show a poisoning attack failing after your controls.
4

Agent and tool sandboxing

Master
Containing what an agent can actually do. Least privilege, tool allow-listing, egress control, and human-in-the-loop gates so that even a hijacked agent cannot cause harm.
Maps to: "agentic security," "tool sandboxing," "least-privilege AI systems."
Frameworks & tools
Tool allow-listingEgress control
Demonstrable artifact
Sandboxed agent: defeat the Offense track's agent-exfiltration attack.
5

Data leakage prevention

Master
Keeping secrets and PII out of model outputs. Redaction, secrets management, memory hygiene across turns, and output scanning. The defensive answer to data extraction.
Maps to: "data leakage prevention," "PII handling in AI systems."
Frameworks & tools
Output redactionSecrets management
Demonstrable artifact
Leakage test suite proving sensitive values never reach the output.
6

Capstone: harden a vulnerable app

Guildmaster
Take an injectable application and defend it end to end, then prove it by throwing the Offense track's attacks at it and showing they now fail. A before-and-after that a security lead can actually evaluate.
Maps to: a portfolio piece showing measurable risk reduction, not just knowledge.
Frameworks & tools
Full stack of controls
Demonstrable artifact
Before/after hardening report, and eligibility for the Defense Guild Seal.
Live
Track 3

Governance · Detection and Compliance

Hiring function: AI Governance, AI Risk and Compliance, Defense and Public-Sector AI Assurance. The bridge to government and defense procurement.
1

The regulatory landscape

Apprentice
The rules that are manufacturing buyers for AI security. What the EU AI Act, the US Executive Order on AI, and the NIST AI RMF actually require, and how they connect to technical controls.
Maps to: "familiarity with AI regulation," "NIST AI RMF," "EU AI Act."
Frameworks & tools
NIST AI RMFEU AI ActUS EO on AI
Demonstrable artifact
Regulatory brief: map a sample AI system to its applicable obligations.
2

NIST AI RMF in practice

Journeyman
Applying the Govern, Map, Measure, and Manage functions to a real LLM system. Turning a framework document into an actual risk process a team can run.
Maps to: "implement NIST AI RMF," the procurement-recognized language defense buyers screen for.
Frameworks & tools
NIST AI RMFRisk registers
Demonstrable artifact
RMF profile for a sample system across all four functions.
3

Risk assessment and red-team reporting

Journeyman
Translating technical findings into governance language. Taking the results of an Offense engagement and turning them into risk statements, severities, and recommendations that leadership and auditors can act on.
Maps to: "AI risk assessment," "security reporting for non-technical stakeholders."
Frameworks & tools
MITRE ATLASRisk scoring
Demonstrable artifact
Risk report that converts a real red-team finding into governance language.
4

Detection, monitoring, and response

Master
Knowing an attack is happening. Logging the right signals, detecting abuse and injection at runtime, and running an incident response process built for AI systems.
Maps to: "AI monitoring," "abuse detection," "incident response for ML systems."
Frameworks & tools
TelemetryAbuse detection
Demonstrable artifact
Detection playbook plus a worked incident timeline for an injection attack.
5

Compliance mapping and audit

Master
Producing the evidence. Mapping technical controls to framework requirements, assembling documentation, and standing up to an audit. The unglamorous work that unlocks regulated and public-sector deployment.
Maps to: "compliance mapping," "audit readiness," "control documentation."
Frameworks & tools
Control mappingEvidence packages
Demonstrable artifact
Control matrix mapping a system's controls to framework requirements.
6

Capstone: authorization package

Guildmaster
Assemble a complete, framework-aligned risk and authorization package for a fictional AI deployment. The document a program office would actually need to sign off. This is the artifact that speaks directly to defense procurement.
Maps to: the procurement-facing deliverable that sets Guild Cyber apart from the tech-only incumbents.
Frameworks & tools
NIST AI RMFAuthorization
Demonstrable artifact
Authorization package, and eligibility for the Governance Guild Seal.
Live
Track 4

Adversarial ML · Attacking the Model Itself

Hiring function: Adversarial ML Engineer, AI/ML Security Researcher, ML Red Teamer. The deep end, where the target is the model's math, not its prompt.
1

Adversarial ML foundations

Apprentice
Where a model can be attacked across its whole lifecycle, not just at the prompt. The taxonomy that organizes every attack in the track: evasion at inference, poisoning at training, and extraction and inference against a deployed model.
Maps to: "adversarial machine learning," "ML threat modeling," MITRE ATLAS.
Frameworks & tools
MITRE ATLASNIST AI RMF
Demonstrable artifact
Attack-surface map of a sample ML system, each surface tied to an attack class.
2

Evasion attacks

Apprentice
Crafting an input that flips a classifier while looking unchanged to a human. Perturbations, gradient-guided methods, and transferability, the property that lets an attack built on one model work on another it never saw.
Maps to: "adversarial examples," "evasion attacks," "model robustness testing."
Frameworks & tools
FGSM / PGDRobustness Toolbox
Demonstrable artifact
Working adversarial example that flips a model's prediction with a change a person cannot see.
3

Data poisoning and backdoors

Journeyman
Planting hidden behavior by tampering with training data. Availability poisoning that degrades a model, targeted poisoning that bends one decision, and backdoor triggers that lie dormant until a chosen input appears.
Maps to: "data poisoning," "backdoor attacks," "training-data integrity."
Frameworks & tools
Trigger backdoorsMITRE ATLAS
Demonstrable artifact
Poisoning scenario documenting the trigger, the planted behavior, and how it evades a clean-test.
4

Model extraction and stealing

Master
Cloning a black-box model through nothing but its own API. Query-based extraction, the cost-versus-fidelity trade-off an attacker manages, and why an exposed model endpoint is a leaked asset, not just a service.
Maps to: "model extraction," "model stealing," "ML API abuse."
Frameworks & tools
Query budgetsExtraction attacks
Demonstrable artifact
Extraction plan that reconstructs a target model's behavior within a set query budget.
5

Membership inference and model inversion

Master
Pulling private training data back out of a model. Membership inference asks whether a specific record was in the training set; model inversion reconstructs the inputs themselves. Both turn a shipped model into a privacy leak.
Maps to: "membership inference," "model inversion," "ML privacy."
Frameworks & tools
Inference attacksDifferential privacy
Demonstrable artifact
Privacy-risk assessment showing what a model leaks about the data it was trained on.
6

Capstone: defending the model

Guildmaster
Hardening a model against the whole taxonomy at once. Adversarial training, input and output defenses, query monitoring and rate limits, and privacy techniques, each mapped to the attack it blunts and each with its honest limits stated.
Maps to: "robust ML," "ML model defense," "privacy-preserving machine learning."
Frameworks & tools
Adversarial trainingDifferential privacy
Demonstrable artifact
Model-defense plan mapping every attack class to a concrete mitigation, and eligibility for the Adversarial ML Guild Seal.
Live
Track 5

AI Supply Chain · Trusting What You Assemble

Hiring function: ML Supply Chain Security, MLSecOps, AI Platform Security. The attack surface almost no one maps: everything a model is assembled from.
1

The AI supply chain

Apprentice
The five links from data to production, data, dependencies, pretrained weights, build and registry, and deploy, and where each one silently trusts someone else. A break in any link travels downstream into everything built on it.
Maps to: "AI/ML supply chain security," "software supply chain," "SBOM."
Frameworks & tools
SLSAMLBOMNIST SSDF
Demonstrable artifact
Supply-chain map of a sample model with every trust boundary marked.
2

Poisoned dependencies and weights

Apprentice
Malicious packages and backdoored pretrained models pulled from public hubs. Typosquatting, dependency confusion, and the classic checkpoint format that runs arbitrary code the instant you load it, so opening an untrusted file is code execution.
Maps to: "dependency security," "malicious packages," "model integrity."
Frameworks & tools
Typosquattingsafetensors
Demonstrable artifact
Triaged risk list of the dependency and weight exposures in a sample project.
3

Model provenance and integrity

Journeyman
Signing, hashing, and verifying that what you deploy is what you actually trained. A signature binds approval to exact bytes, an MLBOM lists what went in, and verify-at-load turns provenance from a document into an enforced gate that refuses a tampered artifact.
Maps to: "artifact signing," "provenance," "SBOM / MLBOM."
Frameworks & tools
SigstoreMLBOMSLSA provenance
Demonstrable artifact
Provenance record plus a verify-at-load gate for a model artifact.
4

Pipeline and CI/CD security

Master
Hardening the build, because the pipeline holds the cloud credentials and the signing key, so compromising it lets an attacker ship whatever they want, signed by you. Short-lived scoped credentials, ephemeral runners, and artifact-tamper protection.
Maps to: "CI/CD security," "secrets management," "build hardening."
Frameworks & tools
OIDCSLSA build levelsEphemeral runners
Demonstrable artifact
Hardened pipeline design with the credential and runner model spelled out.
5

Third-party and foundation-model risk

Master
Assessing hosted models and vendors, and controlling where your data goes. Every prompt to a hosted model crosses your trust boundary: send only what the task needs, confirm retention and no-train terms, and build for provider deprecation and outage.
Maps to: "third-party risk," "vendor assessment," "data governance."
Frameworks & tools
Vendor terms / DPAEgress controls
Demonstrable artifact
Vendor assessment and a data-egress policy for a hosted foundation model.
6

Capstone: supply-chain assurance

Guildmaster
Proving the whole chain is trustworthy, end to end. A chain is only as strong as its least-verified link, so every link needs evidence, not a promise, and because the chain changes constantly, a one-time attestation is stale immediately, verification has to be continuous.
Maps to: "supply-chain assurance," "attestation," "continuous verification."
Frameworks & tools
SLSAAttestationMLBOM
Demonstrable artifact
Signed chain attestation covering every link, and eligibility for the Supply Chain Guild Seal.

Why this sequence wins the niche

The tech-focused incumbents teach the same frameworks, but they were built for engineers and are not set up to speak to commanders or align with defense procurement. This curriculum deliberately runs the same student from a browser-based first jailbreak all the way to a NIST-aligned authorization package. That arc is the differentiator: it produces people who can both break an AI system and explain the risk in the language a program office signs against.

Every module here is scoped to end in a portfolio artifact, because that is what AI security actually hires on. The certificate is the record of the work, never a substitute for it.