A book, woven from a course

Machine Learning in Systems and Network Security

DS 6042 · Summer 2026 · Daniel G. Graham, UVA School of Data Science

This course is built around sixteen labs. Together they answer a question every security course should ask, and most don't: what does it actually mean to attack — or defend — a system that runs machine learning? You start with a first hands-on exploit on the cyber range, move on to small but real LLMs and agents, then work through the core AI-security attacks: on agents, on MCP, and on RAG. From there you harden real deployments, both server-side and in the cloud, and finish with the classic machine-learning intrusion-detection lab the field began with. Every lab has the same shape: build the smallest version, attack it, then fix it.

How to use this book

Open a lab page from the table below and read the lede + the §1 anatomy callout before doing anything else. Then walk the build code while the file is open. Run the attack scripts. Read the secure-phase fixes; argue with them. The labs are designed for in-class use (≈2 hours apiece) and the leftover time becomes the assignment.

View the day-by-day Summer 2026 schedule →

Day-by-day schedule

OrientationDay one

Your first exploit · ProFTPd mod_copy

Team setup, cyber-range onboarding, end-to-end walkthrough of CVE-2015-3306 on Metasploitable 3 (manual SITE CPFR/CPTO → webshell via Apache, then the Metasploit module). The orientation lab — frames everything that follows.

Module 01LLM foundations

microGPT — guided walkthrough

Hand-trained, hand-traced 2-layer transformer. The canonical reference for widget-rich didactic labs.

Train nanochat on Rivanna

Train and serve your own ChatGPT-style model on UVA Rivanna/Afton via Open OnDemand Code Server. The scaled-up sequel to microGPT.

Module 02AI agents · build → break

microagent — guided walkthrough

The agent half of Lab 02 microGPT. Read the smallest possible ReAct agent (one tool, one loop, one file), then scale up to the production-shape baseline_agent students attack next.

Attacking AI agents

Stand up the production-shape ReAct agent against Rivanna's Kimi K2. Three canonical attacks (prompt extraction, document fragmentation, memory poisoning), then three documented defenses.

Module 03Model Context Protocol · build → break

microMCP — guided walkthrough

The whole Model Context Protocol on one screen — JSON-RPC, two tools, no dependencies — then a side-by-side with the production server students attack in Lab 07.

Five canonical MCP attacks: description poisoning, path traversal (CVE-2025-53109 / 53110), over-privileged DB tool, MCP Apps UI poisoning, Jinja2 SSTI through a three-tool chain to RCE.

Module 04Applied tooling · OSINT, agents, pentest

HIBP + Shodan + Shadowbroker aggregator with k-anonymity and OSINT × ML pipeline coverage. Profile yourself; build a defensive remediation list.

Agentic engineering

What agents and skills are; Claude Code + gstack setup; ship a small security tool end-to-end with the sprint flow.

Agentic pentesting

Same Kali + Metasploitable as Lab 01, but the agent does the typing. PTES-format report as deliverable.

Module 05Alignment & refusal

Unaligned models

Abliteration, the Dolphin family, the refusal direction in 2D — and a Llama-Guard-style classifier as the assignment deliverable.

Module 06Secure deployment

Secure deployment · servers

The nine-layer AI component stack; STRIDE-per-layer; hands-on vLLM hardening; harden-one-layer assignment.

Secure deployment · cloud

Shared-responsibility per layer; NSA seven principles; Vertex deployment hands-on; deploy + peer-pen-test assignment.

Module 07Retrieval-Augmented Generation · build → break

microRAG — guided walkthrough

The RAG entry in the "smallest readable" family. Chunk, two indexes (TF-IDF + hashed-feature embeddings), hybrid retrieval, prompt augmentation, LLM call — ~200 lines.

Five canonical RAG attacks against a production-shape FastAPI twin: KB leakage, ingestion poisoning, embedding collision, retrieval hijacking, pattern-match filter bypass.

Module 08Classical ML in network security

microNIDS · build → break → secure

ML for network intrusion detection. Gradient-boosted classifier on NSL-KDD flow features; three adversarial flow attacks (feature perturbation, packet padding, slow-and-low timing); two layered defenses (model-diversity ensemble + per-feature envelope). The lab where the course's title meets its content most directly.

microfake · deepfakes from first principles

Build the generative machinery from scratch — autoencoder face-swap → GAN → diffusion, plus a toy video generator — then turn defender and build deepfake detectors (frequency artifacts, density gaps, learned classifiers). The generative-models finale; replaces the former capstone project.