Is this a video course?

No. This is an interactive, slide-based learning platform. Each lesson has rich text, animated diagrams, live code editors, and quizzes. You learn by reading, interacting, and doing, not by watching videos passively.

How long do I have access?

Forever. Both pricing tiers are one-time payments with lifetime access. This includes all current 766 lessons and any future content we add.

What level of experience do I need?

None. We start from absolute basics like 'What is latency?' and build up to distributed consensus protocols. The Foundation level assumes zero prior knowledge of system design.

How much does the system design course cost?

7.99 US dollars for lifetime access globally, or 499 Indian rupees for lifetime access in India. One-time payment, no subscription, no hidden fees. 11 lessons are free with no signup required.

What technologies are covered?

Everything from DNS and load balancers to Kubernetes, Kafka, distributed databases, consensus protocols, stream processing, security architecture, and observability. We cover principles and real-world implementations used at Netflix, Google, Amazon, Uber, Stripe, and more.

Is this useful for system design interview preparation?

Yes. The lessons are structured around the exact topics asked in system design interviews at FAANG and top-tier companies. Interactive diagrams help you practice whiteboard-style explanations. Covers everything from URL shortener design to distributed payment systems.

How is this different from ByteByteGo or Educative?

766 interactive lessons (4x more than most competitors), 16 different diagram types that build step by step, real production examples from Netflix, Google, Amazon, Uber, and Stripe, and lifetime access for a one-time payment of $7.99 instead of annual subscriptions costing 100 to 200 dollars per year.

How does zero-click data exfiltration work in an LLM app?

A steered model writes a markdown image whose URL points at an attacker server and carries a secret in the query string. When the chat interface renders the answer, the user's browser automatically fetches that image URL to display it, and the request carries the secret to the attacker with no click from the user. The classic public case is EchoLeak against Microsoft 365 Copilot, tracked as CVE-2025-32711.

Why doesn't a sandbox egress proxy stop markdown image exfiltration?

Because the image fetch originates in the user's browser, not the agent's backend. A server-side egress proxy governs only what the agent process connects to, so it catches the tool-call channel but never sees the browser fetching an image URL from the user's own machine. Closing that channel needs a browser-enforced control like a Content Security Policy, or sanitizing the output before it leaves the server.

How does a Content Security Policy prevent data exfiltration?

A CSP is an HTTP header the browser enforces on the page rendering model output, and its img-src directive lets images load only from approved hosts. The browser refuses to fetch an image from any host not on the list, so a URL pointing at an attacker is dropped before the request goes out and the secret never leaves the machine. connect-src, frame-src, and form-action close the scripted-fetch, iframe, and form paths the same way.

What are the main data exfiltration channels for a steered LLM?

There are four: a rendered image URL that fires on render with no click, a crafted hyperlink that carries the secret and needs a click, a tool call to an attacker-controlled endpoint that sends data server-side, and data smuggled into an otherwise normal answer using invisible Unicode characters or plaintext read later. The image and link fire in the browser, the tool call fires in the backend, and each needs a different control.

Why use a host allowlist instead of scanning URLs for secrets?

Because a secret can hide in the subdomain, the path, the query string, or the fragment of a URL, and a scanner that checks one slot misses the others, while a subdomain payload can even leak through DNS before any HTTP request. An allowlist of approved destination hosts refuses the whole request when the host is not approved, no matter where the data was hidden, so it checks the small closed set of allowed destinations rather than the unbounded set of possible payloads.

How do you stop bulk data exfiltration through image URLs?

Log and rate-limit outbound volume per session, because a large secret cannot fit in one URL. A single image URL carries roughly 1.5 KB after base64 overhead, so moving a document takes dozens to hundreds of image loads to one host, which is an anomaly against the baseline of a few first-party loads per answer. Rate-limiting turns an instant dump into a slow crawl you can catch, though a small secret like an API key still fits in one request and must be caught by the host allowlist and signature scan.

Your agent has a default-deny server-side egress proxy that blocks any tool call to a non-allowlisted host. A markdown image in the model's answer still exfiltrates a secret. How?

The image fetch originates in the user's browser, not the agent process, so it never crosses the server-side proxy, There are two egress boundaries. The server-side proxy governs what the agent process connects to, which covers the tool-call channel. But when the browser renders the answer and fetches the image URL, that request comes from the user's machine and never reaches the server proxy. Closing the image channel needs a browser-enforced control such as a Content Security Policy, or sanitizing the output before it leaves the server. A perfect server-side allowlist does nothing for a leak that fires in the browser.

A team proposes stopping image exfiltration by scanning every emitted image URL's query string for base64-looking data and stripping it. Why is a host allowlist the better control?

A secret can hide in the subdomain, path, or fragment instead of the query string, and a subdomain payload can leak through DNS before any HTTP request; an allowlist refuses the whole request regardless of where data is hidden, A URL has several slots for a payload. Encoding the secret as a subdomain leaks it through DNS resolution before any HTTP request, and putting it in the path defeats a query-string scrubber. Scanning one slot leaves the others open, and the set of possible encodings is unbounded. An allowlist checks the destination host, a small closed set, and drops the entire request when the host is not approved, so it does not matter which slot the data was hidden in.

You are estimating exfiltration bandwidth. A URL is capped near 2048 characters, and base64 inflates 3 raw bytes into 4 characters. Which statement is correct about which control catches which leak?

A single URL carries roughly 1.5 KB, so an API key leaves in one request that only content controls can catch, while a multi-megabyte document needs hundreds of loads that volume monitoring can flag, After the fixed prefix and base64 expansion, one image URL carries about 1512 bytes. A 40-byte key or a 1.2 KB token fits in a single request that looks like any other image load, which volume monitoring cannot distinguish, so the host allowlist and signature scan must catch it. A document is far larger than one URL can hold, so moving it takes hundreds of loads to one host, and that burst against a baseline of a few first-party loads is exactly what volume monitoring and rate-limiting are built to catch. The size of the secret decides the control.

The lesson frames exfiltration defense as two independent axes. Which pair correctly describes them?

Least privilege limits what a steered model can reach, and egress control limits where reached data can go; a successful leak needs both to be open, Containment has two axes, and a leak needs both open. Least privilege, from the identity lesson, decides how much a steered agent can even touch, so tightening it can leave nothing worth stealing. Egress control, this lesson, decides whether reached data can leave, so tightening it leaves a model holding a secret with nowhere to send it. Close either and the chain breaks. Both are built as structural limits rather than filters, because a persistent attacker eventually beats a probabilistic control. EchoLeak completed because both axes, plus the untrusted input, were open at once.

Data Exfiltration and Egress Control in LLM Systems

Name: System Design Masterclass
Availability: InStock

in Security

This lesson is part of the ML Platform Engineering course. Unlock the full course, a separate one-time payment, for lifetime access.

One-time payment. Lifetime access. No subscription.

Global

$20/lifetime

One-time payment via PayPal

Get Lifetime Access

5 Foundation lessons free, try before you buy

India Special

India

₹999/lifetime

One-time via UPI, cards, or net banking

Get Lifetime Access

5 Foundation lessons free, try before you buy

“The interactive diagrams alone are worth way more than the price.”

Anish K., Senior Engineer at a Bengaluru startup

Every ML Platform lesson, Foundation to Advanced

Real architecture diagrams with real tool logos

MLOps, LLMOps, and data engineering in depth

Quizzes with instant feedback

Built and reviewed by senior engineers

Lifetime access, all future content included

The first 5 Foundation lessons of this course are free, no payment needed. Try them now