Vinaya Vasudevan · AI Security Engineer

01 · about

Engineer. Practitioner.
AI security specialist.

I started in Electrical and Electronics Engineering, then moved deliberately into cybersecurity. I hold a Master's in Cybersecurity Operations and Leadership from the University of San Diego (3.98 GPA, Merit Scholarship) and 3+ years of experience in AppSec, DevSecOps, and AI security.

My work sits at the intersection of offensive and defensive security. I run deep-dive application, API, and AI security assessments in federal and enterprise environments, build and harden CI/CD pipelines, and architect cloud security controls in AWS and GCP.

My current focus is LLM and AI agent security: prompt injection, data poisoning, model leakage, supply-chain compromise, and RAG/agentic workflows. I hold the CAISP certification, have attacked and hardened RAG systems, and actively map AI attack surfaces to OWASP LLM Top 10 and MITRE ATLAS.

I believe security teams should be enablers, not gatekeepers — so I build tooling and workflows that make the right security decisions the easy ones.

I mentor through WiCyS and spoke at The Diana Initiative 2026 on AI security fundamentals.

M.S. Cybersecurity Operations & Leadership

University of San Diego · 2022

GPA 3.98 · Merit Scholarship

Professional Cybersecurity Bootcamp

UT Austin · 2019

B.E. Electrical & Electronics Engineering

Anna University, Chennai · 2013

Years in cybersecurity

3.98

Master's GPA · USD

30%

Risk exposure reduced at Gunnison

20%

Remediation cycle cut at Synopsys

~/ai-security $ whoami

vinaya · ai-security-engineer

~/ai-security $ cat focus.txt

prompt_injection · rag_abuse · adversarial_ml
data_poisoning · supply_chain · llm_guardrails

~/ai-security $ certifications --list

CAISP ✓ · SANS AIS247 ✓ · CEH ✓ · Security+ ✓

02 · ai security case studies

Red teaming and guardrail-building
for AI systems.

Hands-on attacks and defenses mapped to OWASP LLM Top 10 and MITRE ATLAS. Click any case study to expand.

RAG Red Teaming: Extracting PII via Prompt Injection

LLM01 · Prompt Injection LLM02 · Sensitive Info Disclosure MITRE ATLAS RAG Security

Problem

A RAG-based AI assistant was exposed to potential prompt injection and data leakage risks. Could an attacker extract PII by manipulating retrieval context or user prompts?

Approach

Built a RAG pipeline with a document store, retrieval layer, and LLM
Designed prompt injection attacks targeting user prompts and retrieval context
Tested jailbreak patterns, indirect prompt injection, and context-collision attacks
Mapped findings to OWASP LLM Top 10 (LLM01, LLM02)

What broke

Successfully extracted PII and internal documents via prompt injection
Demonstrated context manipulation forcing the LLM to return confidential data

Guardrails built

Evaluated LLM Guard for prompt sanitization and output filtering
Designed input validation and output handling patterns to reduce injection risk
Created AI threat models using IriusRisk to document attack surfaces
Integrated AI security checks into CI/CD pipeline for early detection

Impact: Established a concrete, reproducible RAG attack pattern. Provided a practical reference for teams building RAG products. All findings mapped to OWASP LLM Top 10 and MITRE ATLAS.

Adversarial ML: Flipping Sentiment Classifiers with Single-Word Substitutions

Adversarial ML MITRE ATLAS · AML.T0015 TextAttack

Problem

A sentiment classifier in production was vulnerable to adversarial inputs that could flip predictions while preserving semantic meaning, bypassing human review.

Approach

Used TextAttack to generate adversarial examples against a sentiment model
Tested single-word substitutions, paraphrasing, and character-level perturbations
Measured prediction confidence deltas and semantic similarity scores

What broke

Single-word input changes flipped model predictions with 99%+ confidence
Adversarial inputs remained semantically consistent while being completely misclassified

Guardrails built

Applied adversarial training and robustness checks to the model
Designed input validation and anomaly detection for suspicious patterns
Mapped attack techniques to MITRE ATLAS adversarial ML framework

Impact: Proved that minimal input changes can cause high-confidence misclassifications. Concrete adversarial ML risk demonstration for AI product teams.

Embedding AI Security Checks into CI/CD Pipelines

DevSecOps Supply Chain LLM08 · Model Integrity Cosign

Problem

AI-powered features were being shipped without LLM-specific security checks. Traditional pipeline scanning missed prompt injection patterns and model integrity risks.

What I built

Integrated AI security tooling into GitLab CI/CD and GitHub Actions
Added checks for prompt injection patterns in templates and configs
Model scanning and signing with Cosign for supply-chain integrity
Automated triage workflows in Python and Bash to reduce manual overhead

Pipeline stages

Scan prompts and templates for injection patterns at commit time
Validate model signatures before deployment
Surface supply-chain risks before they reach production

Impact: Early detection of AI-specific risks before production. Reduced manual security overhead and improved fix rates across the delivery pipeline.

03 · expertise

What I bring to
the table.

🤖

AI Security

Assessing LLMs for prompt injection, jailbreaks, data poisoning, and supply chain compromise. Mapping attacks to architectural layers.

OWASP LLM Top 10MITRE ATLASTextAttackLLM GuardIriusRiskCAISP

🛡️

Application & API Security

Web and API pentesting, OWASP Top 10 / API Top 10 / ASVS assessments, SAST/DAST/SCA tooling, and threat modeling.

Burp Suite ProZAPHP WebInspectSTRIDEDREAD

☁️

Cloud & Container Security

Container image scanning, AWS security services, Kubernetes hardening, infrastructure-as-code security across DevOps environments.

AWS Security HubGuardDutyTrivyGrypeSyftGCPK8s

🔁

DevSecOps

Embedding security throughout the SDLC. CI/CD pipeline hardening, SAST/DAST integration, secrets management, and container security.

GitHub ActionsGitLab CI/CDSemgrepCheckovGitleaksTerraform

⚙️

Security Automation

Automated vulnerability triage workflows, SAST/DAST integration, and custom scripting to eliminate manual security overhead at scale.

PythonBashPowerShellJavaScript

🔍

Vulnerability Management

CVSS-based triage using NVD and NIST controls, enterprise-scale scanning platforms, business-aligned remediation prioritization.

TenableQualysNessusAcunetixCVSS/NVD

04 · experience

Where I've worked.
What I've secured.

Feb 2025 – Present

AI Security Practitioner

Independent Research

Completed CAISP with hands-on labs covering adversarial ML, RAG pipeline security, supply chain attacks, prompt injection, model scanning, and model signing with Cosign
Built and attacked RAG systems, extracting PII via prompt injection; mapped findings to OWASP LLM Top 10
Conducted adversarial ML attacks using TextAttack — demonstrated single-word input changes that flip model predictions with 99%+ confidence
Explored LLM Guard, IriusRisk AI threat modeling, and MITRE ATLAS integrated into CI/CD pipelines
Spoke at The Diana Initiative 2026 on AI security fundamentals for practitioners
Selected as exclusive beta tester for TryHackMe's AI Security certification

CAISP certified · Hands-on RAG exploitation · Adversarial ML research

Mar 2023 – Feb 2025

Security Engineer

Gunnison Consulting Group · Client: US Federal Courts · Remote

Performed deep-dive manual security reviews of web applications and APIs using Burp Suite Pro, Nessus, and Acunetix; remediation guidance mapped to OWASP Top 10 and CWE
Conducted threat modeling using STRIDE during design-phase reviews, identifying risks before code was written
Built and maintained scalable CI/CD pipelines using GitLab CI/CD and GitHub Actions; configured Docker and AWS EC2/ECS execution environments
Architected cloud configurations in AWS and GCP (IAM, VPC, EC2, Security Hub, WAF) using Terraform to enforce automated baselines
Container and dependency scanning using Trivy and Grype across Kubernetes-based pipelines
Engineered automated triage workflows in Python and Bash; delivered executive-level security briefings

↓ 30% high-risk exposure · STRIDE threat modeling · CI/CD security integration

Mar 2020 – May 2021

Application Security Specialist

WhiteHat Dynamic by Synopsys · Houston, TX

Configured and optimized WhiteHat Sentinel scanning across client environments; improved accuracy and reduced false positive rates
Performed threat modeling, CVSS-scored vulnerability analysis, and proof-of-concept exploit development
Served as escalation point for complex AppSec issues; coordinated with global engineering and security teams
Supported client risk prioritization and compliance alignment across PCI-DSS and ISO 27001

↓ 20% remediation cycle time · PoC-backed guidance

05 · projects

Things I've built
and broken.

Portfolio projects demonstrating hands-on AI security research and tooling.

⚔️

TextAttack Adversarial ML: Attacking a Sentiment Classifier

Built a DistilBERT-based sentiment classifier, then used TextAttack's TextFooler recipe to generate adversarial examples. Single-word substitutions flipped model predictions with 99%+ confidence while preserving semantic meaning. Mapped to MITRE ATLAS AML.T0043.

Adversarial ML MITRE ATLAS · AML.T0043 TextAttack DistilBERT TextFooler

MODEL

distilbert-base-uncased-finetuned-sst-2-english · fine-tuned on SST-2 dataset · CPU/GPU via PyTorch

ATTACK RECIPE

TextFoolerJin2019 — synonym substitution preserving semantic similarity · 20 examples · results logged to CSV

WHAT I BUILT

Custom SentimentWrapper class bridging HuggingFace inference with TextAttack's attack loop · per-example word-change metrics · attack_summary.txt output

STACK

Python · PyTorch · HuggingFace Transformers · TextAttack 0.3.10 · NLTK · scikit-learn

BEST ATTACK — EXAMPLE 12

ORIGINAL

"I think this product is nice and works well for my needs."

POSITIVE · 99.66% confidence

ADVERSARIAL

"I think this product is nice and works better for my needs."

NEGATIVE · 99.79% confidence

"well" → "better" is semantically more positive in plain English — yet the model flipped with higher confidence. "better" may signal implicit comparison, implying something else was worse. Training bias at work. This is the attack surface.

Demonstrated that single-word synonym substitutions flip high-confidence predictions — model is vulnerable to semantically-preserving perturbations that bypass WAF and regex entirely
Built custom ModelWrapper class converting HuggingFace softmax outputs to the [negative_prob, positive_prob] tensor format TextAttack expects
Ran 20-example attack dataset with TextFoolerJin2019; collected word modification rate per example and overall success rate
Mapped attack to MITRE ATLAS AML.T0043 (Craft Adversarial Data) and OWASP LLM09 (Misinformation)
Defense takeaways: adversarial training, input normalization before tokenization, ensemble-based anomaly detection — signature-based tools are blind to this class of attack

📋

AI System Threat Model — STRIDE + IriusRisk

End-to-end threat model of an AI training and inference system using STRIDE methodology and IriusRisk. Five trust zones, ten ranked threats, countermeasures mapped to OWASP LLM Top 10 and MITRE ATLAS.

IriusRisk STRIDE MITRE ATLAS OWASP LLM Top 10 Threat Modeling

SCOPE

Full AI-connected system — training pipeline through inference endpoint

METHODOLOGY

STRIDE mnemonic · (Likelihood + Impact) / 2 risk scoring · IriusRisk automated threat generation

TRUST ZONES

External · DMZ · Internal Interface · Internal Protected · Internal Development

REPORTS GENERATED

Risk Summary · Technical Threat · Technical Countermeasure · Compliance (PDF)

ARCHITECTURE — 5 ZONES, 9 COMPONENTS

External: User → Browser/App · DMZ: API Gateway/Proxy · Security Auth System · Internal Interface: AI Model (Inference) · Internal Protected: Data Layer (User Data) · Logs · Internal Dev: Training Data · Model Training Pipeline

THREAT REGISTER — RISK RANKED

STRIDE	THREAT	RISK
Spoofing	Attacker spoofs user identity	Critical
Spoofing	Adversary deploys fake AI model (evil twin)	Medium
Tampering	Attacker tampers with training data (poisoning)	High
Tampering	Malicious data injected into trained model weights	Medium
Repudiation	Attacker deletes or alters audit logs	Medium
Info Disclosure	AI system discloses PII / confidential data	Critical
Info Disclosure	Attacker reverse-engineers model via repeated queries	High
Denial of Service	Attacker floods AI service with excessive requests	Critical
Denial of Service	Overload training resources / crash pipeline	Medium
Elevation	Exploit API Gateway / Auth to reach training pipeline	Medium

Imported AI reference architecture into IriusRisk as DFD with typed components (API Gateway, AI Model, Data Layer, Training Pipeline) across five trust zones
Completed component questionnaires for Data Layer (PII / data at rest) and API Gateway (data flows, auth context) to drive relevant threat generation
Ran automated threat generation; reviewed output under Spoofing, Tampering, Info Disclosure, DoS, and Elevation of Privilege
Scored each threat using (Likelihood + Impact) / 2 — three Critical, two High, five Medium threats identified
Applied OWASP ASVS Level 1 + STRIDE security properties as baseline requirements: Authentication, Integrity, Non-Repudiation, Confidentiality, Availability, Authorization
Exported Current Risk Summary, Technical Threat, Technical Countermeasure, and Compliance PDF reports from IriusRisk

🎓 Coming Soon

LLM Security Fundamentals Course

90-minute course built from TDI 2026 talk: "LLM Security Fundamentals: From Architecture to Attack Surface." Covers embeddings, tokenization, attention mechanisms, prompt injection, data poisoning, and RAG security.

Course OWASP LLM Top 10 TDI 2026

🧪 Coming Soon

Vulnerable RAG Agent (Lab)

A deliberately vulnerable RAG pipeline with document store, retrieval layer, and LLM — built for red teaming prompt injection, PII leakage, and context-collision attacks. Write-up will be mapped to OWASP LLM Top 10.

Prompt Injection RAG LLM01/LLM02 In Progress

07 · speaking

Taking AI security on stage.

The Diana Initiative 2026 · 31 Slides · May 30, 2026

Before You Hack It, Understand It:
AI Security Fundamentals

🌐 Online · 🕐 Pacific Daylight Time · ⏱ 26 minutes

Security practitioners are increasingly handed AI targets to audit — yet many still treat the model as a black box. This talk opens that box: eight processing layers between user input and model output, each one mapped to its attack surface. From tokenization tricks that bypass WAFs to temperature abuse at inference time — with every attack mapped to OWASP LLM Top 10 and MITRE ATLAS.

Prompt Injection Data Poisoning Adversarial ML Supply Chain MITRE ATLAS OWASP LLM Top 10 RAG Security LLM Architecture

01 · ARCHITECTURE

The Neural Building Blocks

8-step pipeline — tokenization → embeddings → context assembly → attention → decoder output. Every layer mapped to its attack surface.

02 · EXPLOITATION

Where Real Attacks Live

Evil twin, data poisoning, supply chain, adversarial inputs, temperature abuse — each attack pinned to the exact layer it targets.

03 · THREAT MODELING

The AI Attack Surface Map

One consolidated table: attack type → pipeline layer → OWASP ID → MITRE TTP → key mitigation. Screenshot and use Monday morning.

04 · ACTION PLAN

5 Questions to Ask

Data provenance, model integrity, input sanitization, inference params, system prompt storage — the audit checklist for any AI system.

CORE THESIS

"AI security is about hardening a probabilistic pipeline — not protecting a smart brain. Stop treating LLMs as black-box magic. Treat them as untrusted execution environments."

Full Slide Deck · 31 Slides

AI_Security_TDI2026_FINAL · The Diana Initiative · May 30 2026

Open full screen ↗

I break AI systems
so yours doesn't.

Engineer. Practitioner.
AI security specialist.

Red teaming and guardrail-building
for AI systems.

RAG Red Teaming: Extracting PII via Prompt Injection

Adversarial ML: Flipping Sentiment Classifiers with Single-Word Substitutions

Embedding AI Security Checks into CI/CD Pipelines

What I bring to
the table.

Where I've worked.
What I've secured.

Things I've built
and broken.

Credentials. Earned,
not collected.

Taking AI security on stage.

Before You Hack It, Understand It:
AI Security Fundamentals

Technical writing for
practitioners.

Beyond
the job.

Let's work
together.

I break AI systemsso yours doesn't.

Engineer. Practitioner.AI security specialist.

Red teaming and guardrail-buildingfor AI systems.

RAG Red Teaming: Extracting PII via Prompt Injection

Adversarial ML: Flipping Sentiment Classifiers with Single-Word Substitutions

Embedding AI Security Checks into CI/CD Pipelines

What I bring tothe table.

Where I've worked.What I've secured.

Things I've builtand broken.

Credentials. Earned,not collected.

Taking AI security on stage.

Before You Hack It, Understand It:AI Security Fundamentals

Technical writing forpractitioners.

Beyondthe job.

Let's worktogether.

I break AI systems
so yours doesn't.

Engineer. Practitioner.
AI security specialist.

Red teaming and guardrail-building
for AI systems.

What I bring to
the table.

Where I've worked.
What I've secured.

Things I've built
and broken.

Credentials. Earned,
not collected.

Before You Hack It, Understand It:
AI Security Fundamentals

Technical writing for
practitioners.

Beyond
the job.

Let's work
together.