Reference

GLOSSARY

The words this field uses, defined in the fewest honest ones. Each entry says what the term means rather than what we sell, and points at the longest thing we have written about it where there is one.

Attacks

What is actually being attempted, and what distinguishes each one from the others.

Prompt injection: Text that a model reads as an instruction when the application meant it as data. The attacker does not need access to your code or your system prompt — they only need their words to reach the model inside something it treats as input. Why regex does not solve it.
Indirect prompt injection: Prompt injection that arrives through content the model retrieves rather than through anything the user typed: a web page it browses, a document in a RAG index, a ticket in a support queue. Nobody hostile ever speaks to the application, which is what makes it hard to see. How it reaches a RAG pipeline.
Jailbreak: A prompt that persuades a model to set aside its own safety training or its system instructions. Related to prompt injection but aimed elsewhere: injection targets the application around the model, a jailbreak targets the model itself. Patterns seen in the wild.
Multi-turn attack: An attack spread across several messages, each harmless read alone, that arrives at a prohibited result by escalation. Also called a crescendo attack. Any detector that scores one message at a time sees nothing wrong at any point.
Tool injection: Injected text that makes an agent call a tool it should not — a shell command, an outbound HTTP request, a file write. The model is working exactly as designed; the instruction it followed was simply not yours. Securing autonomous agents.
System prompt leak: Getting a model to repeat the instructions it was given. Usually reconnaissance rather than the goal: the system prompt often names tools, data sources and rules that make the next attack cheaper.
Obfuscation and evasion: Encoding an attack so that pattern matching does not recognise it — base64, homoglyphs that look like Latin letters but are not, zero-width joiners inserted mid-word, leetspeak. The model decodes it anyway, which is the entire problem. Normalization before detection.
Shadow AI: AI tools staff adopt without the organisation knowing: a personal chatbot account, a browser extension, an IDE assistant. Not an attack, but the same exposure — company data reaching a model nobody approved. Discovering unsanctioned use.

Defenses

The controls, and what each one can and cannot be relied on to do.

LLM firewall: A control that inspects prompts and responses between an application and its model provider and decides before the request reaches the model. The name borrows from network firewalls and carries the same caveat: it is a boundary control, not a guarantee about what happens inside.
Guardrails: An umbrella term for anything constraining model behaviour, which is why it is worth asking what someone means by it. It stretches from a sentence in a system prompt to a separate detection engine with its own benchmarks.
Containment: Refusing what the user was never authorised to do, instead of trying to recognise every attack that might ask for it. It is the complement to detection rather than a replacement: detection has a miss rate, and containment is what still holds on the requests detection missed. Default-deny for agents.
PII redaction: Removing or masking personal data before it reaches a model. The hard part is not matching a credit-card number, it is coverage across formats and locales — PromptGuard detects 43 entity types. What is detected, and how.
Reversible tokenization: Replacing a sensitive value with a placeholder that can be restored after the model answers, so the model keeps enough context to be useful and the data never leaves your side. The alternative, deleting the value outright, often destroys the request along with the risk. Replacing PII without breaking intent.
Red teaming: Running adversarial attacks against your own application to find what gets through, before somebody else does it for you. Distinct from a benchmark: a benchmark scores a detector, red teaming scores the system you actually deployed. Automated red teaming.
Shadow mode: Running a detection change against live traffic while only logging what it would have done. It is how you find out what a policy change costs in false positives without any customer paying for the answer. Testing changes without blocking.
Defense in depth: Layering controls that fail in different ways, so no single miss is decisive. PromptGuard runs 6 layers; the argument for layering is not that each is strong, it is that a payload evading one rarely evades all of them. The layers, named.

Measurement

The vocabulary for judging a claim. Any vendor quoting one of these without a dataset, a sample count and an interval is quoting a number you cannot check.

Precision: Of everything a detector blocked, the share that deserved blocking. Low precision means real users are being stopped doing legitimate work, which is the failure mode that gets a security product switched off.
Recall: Of every attack actually present, the share the detector caught. Precision and recall move against each other as the threshold moves, so a figure for one, published without the other, says almost nothing.
F1 score: The harmonic mean of precision and recall — one number for a two-number trade-off. Useful for comparing runs of the same system; misleading across systems measured on different data. Our benchmark and its method.
Over-defense: Blocking benign input that merely looks like an attack — a security question, a quoted phishing email, a penetration-test writeup. Measured separately from precision because the benign set is chosen adversarially rather than sampled from ordinary traffic.

Deployment and compliance

Terms that decide whether a security review can approve a deployment at all.

OWASP LLM Top 10: The reference list of risks specific to LLM applications, maintained by OWASP. It is the vocabulary most security reviews are written in, which makes coverage against it a procurement question rather than an engineering one. A practitioner reading of the list.
Air-gapped deployment: Running with no outbound network connection at all — not restricted egress, none. It changes the question a security review has to answer, because data cannot leave infrastructure that cannot reach the internet. Air-gapped AI security.
Zero-retention mode: Processing a request without writing prompt or response content to disk. Decisions and metadata are kept so the audit trail survives; the text itself is not. What happens to your data.
Model Context Protocol (MCP): An open protocol for connecting models to external tools and data sources. It standardises the connection, which also standardises the attack surface: anything an MCP server can reach, an injected instruction can try to reach through it. Securing tools behind one server.