How machines learn, who owns which pipeline, how data stays private, and how all of it gets attacked.Rooted in Domain 1.0’s AI concepts, with honest field trips into Domains 2, 3, and 4. Every slide wears its real objective number.
THE CLASSIC MIX-UP MLOps vs Platform
The classic mix-up is a job description.MLOps engineers orchestrate retraining pipelines, rollback, and system version history.Platform engineers keep the shared compute, secure storage, and registries running underneath them.
1.1 · TYPES & TECHNIQUES
secai+ cy0-001 · objective 1.1 · compare and contrast AI types and techniques · domain 1.0
Statistics explains. ML never stops studying.
Statistical learning builds mathematical models to explain and predict system behavior.
Machine learning is not a rival discipline. It is the same foundation with an engine bolted on.
ML leverages those statistical models to build systems that learn complex patterns automatically and sharpen their predictions as new data arrives. The math stays; the manual stops.
THE LESSONMachine learning directly builds on statistical learning foundations: one explains behavior, the other automates the learning of it. Foundation first, automation second.
1.1 · SUPERVISED vs UNSUPERVISED
secai+ cy0-001 · objective 1.1 · model training techniques · domain 1.0
Labels teach. Clusters tattle.
Supervised learning trains on historical, labeled pairs: this login was malicious, that one was benign.
Unsupervised learning gets no labels at all. It groups events by mathematical similarity and flags whatever refuses to fit.
A supervised model scores incoming events on extracted features like usernames, login times, failure velocity, and source IPs. A clustering model needs none of that homework, and it will flag your best analyst’s 3 a.m. login right beside the intruder’s.
THE LESSONClustering alone buys anomaly detection at the price of higher false positives: benign deviations get flagged while a quiet, slowly executed attack strolls under the baseline. When labels exist, use them.
1.1 · REINFORCEMENT LEARNING
secai+ cy0-001 · objective 1.1 · model training techniques · the third teacher
No labels. No clusters. A scoreboard.
The third way to train: an agent acts, the environment scores the action, the policy updates.
Reinforcement learning chases a reward signal through trial and error. No labeled history, no similarity math: just actions, consequences, and a policy that slowly learns which moves pay. It is how systems learn to act, not merely to classify.
THE LESSONReinforcement learning trains on a reward signal rather than labels or similarity. Objective 1.1 lists all three: know which feedback teaches which learner.
3.2 · ADVERSARIAL NETWORKS
secai+ cy0-001 · objective 3.2 · how AI enables or enhances attack vectors · domain 3.0
Your filter is training its own enemy
Attackers run models against your models, and your verdicts are their training data.
Send a malicious message, watch what gets blocked, let the adversarial network tweak the wording, phrasing, or layout, and try again. The feedback loop mass-produces synthetic variants that keep their payload and lose their fingerprint.
THE LESSONAdversarial ML systematically generates polymorphic variants that preserve malicious functionality while evading signature-based and pattern-matching detection. A static signature cannot hold a moving line.
ENRICHMENT · FEDERATED LEARNING
not on the cy0-001 objectives · enrichment · know it for the real world, not the scantron
Privacy by staying home
Federated learning trains on-device, so raw data never leaves the phone, the car, or the sensor.
The privacy is real. So is the imbalance it smuggles in.
A few data-rich servers and laptops sit beside thousands of data-scarce IoT devices, and the rich ones dominate every training round. Their outsized contributions skew the model’s influence and drift it away from the fleet it serves.
THE LESSONDecentralized training inherits device heterogeneity: vastly different data volumes mean unequal influence and potential global model drift. Privacy solved is not balance solved.
4.1 · AI-RELATED ROLES
secai+ cy0-001 · objective 4.1 · governance structures that support AI · domain 4.0
Four engineers, four deliverables
Data engineers clean and label: ingestion pipelines, datasets, feature vectors.
AI threat modeling starts at the intake valve, because everything a model ingests is attack surface and liability at once. Mishandle it and the exposure is legal, compliance, and privacy, all in the same incident.
THE LESSONAll sensitive inputs get strict input validation and travel encrypted in transit and at rest. Model the data before you model the threat.
1.3 · THE AI LIFE CYCLE
secai+ cy0-001 · objective 1.3 · security throughout the life cycle of AI · domain 1.0
Security rides every stage
The life cycle: business use case, data collection, preparation, development, evaluation, deployment, validation, monitoring, feedback.
Objective 1.3 asks one question of each stage: where does security board?
At collection, the tested words are trustworthiness and authenticity of the data. Before launch, model evaluation and validation. After launch, monitoring, maintenance, and the feedback loop that folds lessons back in. And humans are designed in from the first diagram, not bolted on after the first incident.
THE LESSONSecurity spans the full life cycle, and human-centric design comes in three named flavors: human-in-the-loop, human oversight, human validation. Know the stages in order and the three humans by name.
2.4 · PRIVACY ENGINEERING
secai+ cy0-001 · objective 2.4 · data security controls · third-party evaluations cameo from 4.3
Strip the names before the model reads
HIPAA and GDPR do not soften because it was an AI that saw the record.
Data minimization and anonymization remove or mask personal identifiers from patient and customer datasets before the AI system ever touches them. Then third-party privacy evaluations audit what remains: consent, retention schedules, and whether the pseudonymization actually holds under pressure.
THE LESSONAnonymization happens before access or processing, and outside auditors verify consent, retention, and pseudonymization robustness. Privacy engineering is pre-processing, not post-incident.
2.4 · HOMOMORPHIC ENCRYPTION
secai+ cy0-001 · objective 2.4 · encryption requirements: in transit, at rest, in use
Math on ciphertext
A third party must run statistical analysis on medical records it is legally barred from reading.
Homomorphic encryption runs the computation directly on the encrypted data. The results come out the other side while the underlying cleartext stays sealed: never decrypted, not once, at any point during processing.
THE LESSONWhen analytics must run without exposure, homomorphic encryption computes on the ciphertext itself. Standard AES-256 cannot: it must decrypt before the analytics run.
Chatbot interactions and customer photo uploads flow straight into the next fine-tune, unverified.
Attackers seed that intake with biased, malicious, or adversarial submissions, and every retraining cycle bakes the corruption deeper into the global parameters. OWASP’s 2025 list files it as LLM04, and it compounds quietly until someone audits the data diet.
THE LESSONPoisoning corrupts training parameters over time; prompt injection manipulates live inference. Do not let a scenario blur them together.
2.6 · MODEL DENIAL OF SERVICE
secai+ cy0-001 · objective 2.6 · the attack · mitigations from 2.2 gateway controls
Forty free accounts and one cruel prompt
Exceptionally long, complex inputs with abnormal token distributions, aimed at a public inference endpoint.
Each request exhausts compute and burns through token budgets until legitimate users get degraded answers or none at all. The mitigation stack is unglamorous, layered, and it works.
THE LESSONEnforce strict input-output token limits, maximum query depth, IP-based request throttling, and rate limits at the API gateway. Meter the door, not the damage.
Fine-tuning a public open-source model inherits whatever its publisher buried in the base weights.
The model behaves perfectly on training and validation, then labels one very specific, unusual merchant code as legitimate, every single time. That trigger pattern survived your clean fine-tune because it never lived in your data at all.
THE LESSONSource base models exclusively from trusted curators, run thorough canary tests, and apply fine-pruning before production. Clean data cannot launder dirty weights.
CY0-001 · THE FOUR DISTINCTIONS
The material lives on four lines
MLOps automates retraining and rollback; Platform owns the servers and storage.
Homomorphic encryption computes on data it never decrypts; AES-256 cannot.
Poisoning corrupts training over time; injection manipulates live inference.
Clustering catches anomalies and false positives in the same net.
Four boundaries, drawn cleanly: that is the material, whatever domain number it wears.
click to begintap to play
SecAI+ CY0-001 · AI ConceptsClick to BeginTap to Play
1 / 14
secai+ study deck // cy0-001
← → navigate · N notes · ctrl+M exhibittap right to advance · left to go backLong press screen for video