◇ OpenCyber Academy
Engineering · Chapter 49 · English

Chapter 49 — Engineering thesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Thesis structure"]
  N2["49.2 Positioning"]
  N3["49.3 Critical evaluation"]
  N4["49.4 Writing for two audiences"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Thesis structure"]
  N2["49.2 Positioning"]
  N3["49.3 Critical evaluation"]
  N4["49.4 Writing for two audiences"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 Thesis structure]
    |
    v
[49.2 Positioning]
    |
    v
[49.3 Critical evaluation]
    |
    v
[49.4 Writing for two audiences]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) write an engineering thesis that presents the problem, design, implementation, verification and lessons of the capstone; (2) position the work against standards and literature; (3) evaluate the work critically; and (4) write for both technical assessors and practitioners.

49.1 Thesis structure

Introduction (problem, client, objectives); background (AI-security concepts and frameworks: NIST AI RMF and AI 100-2 E2025, OWASP LLM 2025, MITRE ATLAS, relevant regulation such as the EU AI Act); requirements and threat model; design and alternatives; implementation; verification and validation; recovery trial; discussion (what worked, what did not, why); limitations and future work; conclusion; appendices (dossier summary, traceability matrix).

The structure follows the engineering work, so the dossier supplies most of the content. Background is kept short and selective, covering only what readers need to understand the design. The discussion explains why things worked or failed, which is where the thesis adds understanding beyond the dossier's list of results.

49.2 Positioning

Explain how your design relates to known patterns and research: for prompt injection, Greshake et al. (arXiv:2302.12173) on indirect injection and Chen et al. (arXiv:2402.06363) on structured queries; for evaluation discipline, Carlini et al. (arXiv:1902.06705). State what is new in your engineering context even if the ideas are known.

Engineering theses rarely invent new attacks or defences. Their contribution is usually applying known ideas to a specific setting, combining them in a useful way and measuring what happens. Saying so plainly is more convincing than claiming novelty. For Bulletin Gate, the quarantine pattern is known; the contribution is a schema with no free text, its measured effect on adaptive attacks and its accuracy cost.

49.3 Critical evaluation

Evaluate against requirements and stakeholder needs, compare with alternatives, and discuss threats to validity: synthetic data, limited adaptive attacks, small user studies. Avoid marketing language.

Critical evaluation asks whether the evidence supports the claims and what else could explain the results. Synthetic data may be easier than real bulletins; an adaptive set written by one team in two weeks may miss attacks a determined adversary would find. Comparing with alternatives, such as a classifier-only design, shows whether the chosen approach was worth its cost. Words like 'secure' or 'robust' without conditions are replaced by measured statements.

49.4 Writing for two audiences

The body is for assessors; an executive summary and a two-page practitioner note translate the results into decisions. Keep numbers consistent across all of them.

Executives want the decision and its risk; practitioners want to know whether to adopt the method and what it costs. The body keeps the full argument for assessors. Consistent numbers matter because a reader who finds a different figure in the summary than in the results will doubt both. Sam generates key figures from one results file so all three documents quote the same values.

49.5 Worked example (synthetic NRS case)

Sam's thesis concluded that Bulletin Gate eliminated instruction text from records reaching Wrench in all 300 adaptive cases (95% upper bound ≈ 1%) with a 1.1-point accuracy cost, and that the main remaining risks were outside the gate: approval behaviour and supplier channel authentication. Sam's limitations section noted that adaptive attacks were written by one other student team in two weeks and that real bulletins might contain formats not represented in the synthetic corpus.

Pointing to risks outside the gate is part of honest evaluation: the gate solved its own problem, but the system's security still depends on people and channels the thesis did not change.

49.6 Errors and limits

A thesis that narrates what the team did, week by week, leaves the reader to judge whether it worked. Inconsistent numbers suggest careless work even when the underlying results are sound. Overstated novelty invites examiners to find prior work and discount the rest. Sam's final check compares every figure in the summary with the results file and every claim of contribution with the positioning chapter.

Exercises

Synthesis

The engineering thesis tells the capstone's story as evidence: problem, design, verification and honest evaluation, positioned against known work and written for decision makers too.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →