AIPSA Study Cards

Master the 14 domains of AI Product Security Assessment.

201 study cards across Map, Attack, Defend, and Evidence pillars—designed for AIPSA certification prep with concepts, scenarios, and controls at four knowledge levels.

Start Speed Run View Certification

Map

Attack

Defend

Evidence

AIPSA Study Flash Cards box and card examples

Short review loops

Use the cards for a quick pass through core concepts before a speed run.

Four-pillar coverage

Prompts span Map, Attack, Defend, and Evidence language used in AIPSA training.

Print-friendly shell

Fronts and backs share the same physical card dimensions for web preview and print checks.

Study deck

Run through the cards

Filter by pillar, shuffle the deck, and flip each card to reveal the answer. 216 cards spanning Map, Attack, Defend, and Evidence.

MAP-APP-0101 / 216

Click card or press Space to reveal answer

← → navigate · Space flips

Card preview

One card per pillar — front and back

Sample front/back pairs from each pillar, rendered through the same card shell.

MAP-ARCH-006 / Map / Control

MapControlAdvanced

MAP-ARCH-006

Secure Architecture & Design

Secure Human Approval

What is the most secure pattern for human approval of high-impact agent actions?

Cue: Show deterministic action diffs and independent source evidence.

MapAnswer

MAP-ARCH-006

Secure Architecture & Design

Present deterministic action diffs and affected resources rather than just a model-generated summary.

Why it matters

Model summaries can omit or distort important details of a proposed action.
Reviewers need independent evidence to make informed, accountable decisions.
Approvals must be auditable and happen before the side effect occurs.

Common trap

Avoid rubber stamp approvals where the human sees no risk indicators or action details.

Human-in-the-loopAccountability

ATT-PI-001 / Attack / Concept

AttackConceptPractitioner

ATT-PI-001

Prompt Injection & Context Security

Context Separation Risk

Why is it risky to mix user-uploaded document text with system instructions without clear labels or delimiters?

Cue: Data can start behaving like instruction.

AttackAnswer

ATT-PI-001

Prompt Injection & Context Security

Untrusted content can be treated as instructions unless the system preserves source authority.

Why it matters

Instruction hierarchy is lost when data and commands share the same context.
The model may fail to distinguish developer intent from document content.
Lack of separation enables indirect prompt injection attacks.

Common trap

Do not assume the model will naturally ignore instructions found inside an uploaded document.

Indirect Prompt InjectionInstruction Hierarchy

DEF-IR-008 / Defend / Scenario

DefendScenarioAdvanced

DEF-IR-008

Silent Model Corruption

A model's outputs gradually become more harmful over time, but no code changed, no new data was ingested, and no alerts fired. How is this possible?

Cue: Drift without obvious cause.

DefendAnswer

DEF-IR-008

Feedback loops, reward signal drift, data drift in retrievals, or cumulative effects of sampling behavior can cause gradual degradation without obvious events.

Why it matters

Models that learn from feedback can be slowly poisoned.
Data quality degradation is a process, not an event.
Some failures are emergent and cross-threshold without alerting.

Common trap

Do not assume a sudden incident response is needed; slow degradation needs trend analysis.

Model monitoringTrend detection

EVD-FOUND-009 / Evidence / Concept

EvidenceConceptFoundation

EVD-FOUND-009

AI System Boundary Definition

What constitutes the boundary of an AI system for security purposes?

Cue: Know what you're defending.

EvidenceAnswer

EVD-FOUND-009

The boundary includes the model, its inputs (direct and retrieved), all tools it can call, configuration, prompts, and outputs. Anything outside that boundary is not your responsibility.

Why it matters

Boundary definition determines what controls apply.
Unbounded systems are impossible to secure.
Change in boundary requires security re-assessment.

Common trap

Do not assume the model is the only part that matters.

System architectureTrust boundaries

AIPSA Study Cards

Master the 14 domains of AI Product Security Assessment.

201 study cards across Map, Attack, Defend, and Evidence pillars—designed for AIPSA certification prep with concepts, scenarios, and controls at four knowledge levels.

Start Speed Run View Certification

Map

Attack

Defend

Evidence

Short review loops

Use the cards for a quick pass through core concepts before a speed run.

Four-pillar coverage

Prompts span Map, Attack, Defend, and Evidence language used in AIPSA training.

Print-friendly shell

Fronts and backs share the same physical card dimensions for web preview and print checks.

Study deck

Run through the cards

Filter by pillar, shuffle the deck, and flip each card to reveal the answer. 216 cards spanning Map, Attack, Defend, and Evidence.

MAP-APP-0101 / 216

Click card or press Space to reveal answer

← → navigate · Space flips

Card preview

One card per pillar — front and back

Sample front/back pairs from each pillar, rendered through the same card shell.

MAP-ARCH-006 / Map / Control

MapControlAdvanced

MAP-ARCH-006

Secure Architecture & Design

Secure Human Approval

What is the most secure pattern for human approval of high-impact agent actions?

Cue: Show deterministic action diffs and independent source evidence.

MapAnswer

MAP-ARCH-006

Secure Architecture & Design

Present deterministic action diffs and affected resources rather than just a model-generated summary.

Why it matters

Model summaries can omit or distort important details of a proposed action.
Reviewers need independent evidence to make informed, accountable decisions.
Approvals must be auditable and happen before the side effect occurs.

Common trap

Avoid rubber stamp approvals where the human sees no risk indicators or action details.

Human-in-the-loopAccountability

ATT-PI-001 / Attack / Concept

AttackConceptPractitioner

ATT-PI-001

Prompt Injection & Context Security

Context Separation Risk

Why is it risky to mix user-uploaded document text with system instructions without clear labels or delimiters?

Cue: Data can start behaving like instruction.

AttackAnswer

ATT-PI-001

Prompt Injection & Context Security

Untrusted content can be treated as instructions unless the system preserves source authority.

Why it matters

Instruction hierarchy is lost when data and commands share the same context.
The model may fail to distinguish developer intent from document content.
Lack of separation enables indirect prompt injection attacks.

Common trap

Do not assume the model will naturally ignore instructions found inside an uploaded document.

Indirect Prompt InjectionInstruction Hierarchy

DEF-IR-008 / Defend / Scenario

DefendScenarioAdvanced

DEF-IR-008

Silent Model Corruption

A model's outputs gradually become more harmful over time, but no code changed, no new data was ingested, and no alerts fired. How is this possible?

Cue: Drift without obvious cause.

DefendAnswer

DEF-IR-008

Feedback loops, reward signal drift, data drift in retrievals, or cumulative effects of sampling behavior can cause gradual degradation without obvious events.

Why it matters

Models that learn from feedback can be slowly poisoned.
Data quality degradation is a process, not an event.
Some failures are emergent and cross-threshold without alerting.

Common trap

Do not assume a sudden incident response is needed; slow degradation needs trend analysis.

Model monitoringTrend detection

EVD-FOUND-009 / Evidence / Concept

EvidenceConceptFoundation

EVD-FOUND-009

AI System Boundary Definition

What constitutes the boundary of an AI system for security purposes?

Cue: Know what you're defending.

EvidenceAnswer

EVD-FOUND-009

The boundary includes the model, its inputs (direct and retrieved), all tools it can call, configuration, prompts, and outputs. Anything outside that boundary is not your responsibility.

Why it matters

Boundary definition determines what controls apply.
Unbounded systems are impossible to secure.
Change in boundary requires security re-assessment.

Common trap

Do not assume the model is the only part that matters.

System architectureTrust boundaries

Master the 14 domains of AI Product Security Assessment.

Run through the cards

LLM Integration Risk Assessment

One card per pillar — front and back

Secure Human Approval

Why it matters

Common trap

Related

Context Separation Risk

Why it matters

Common trap

Related

Silent Model Corruption

Why it matters

Common trap

Related

AI System Boundary Definition

Why it matters

Common trap

Related

Master the 14 domains of AI Product Security Assessment.

Run through the cards

LLM Integration Risk Assessment

One card per pillar — front and back

Secure Human Approval

Why it matters

Common trap

Related

Context Separation Risk

Why it matters

Common trap

Related

Silent Model Corruption

Why it matters

Common trap

Related

AI System Boundary Definition

Why it matters

Common trap

Related