Prompt-Attack Detection

The Secure60 AI Protector checks every prompt on its way to the model for prompt-injection and jailbreak attempts. A finding is recorded on the call in the AI audit trail, can block the call, and raises a threat through the managed AI Protector rule pack.

What is checked

Prompt-injection detection runs on the input direction of a guardrail policy, over the parts of the request the policy scans:

Scanned	Default	Covers
User messages	always	every user turn of the conversation
Tool results	on	data a tool returned that is now being sent to the model, the path for indirect injection through documents, web pages and tickets
Earlier tool calls in the history	off	assistant tool calls replayed in the conversation
System prompt	off	the application’s own instructions; on when prompts are loaded from a store that others can write to

Detectors

Engine	How it works
heuristic (default)	A phrase list of known injection and jailbreak wording, matched case-insensitively. The list can be replaced per policy to drop a phrase that matches legitimate traffic or add your own
classifier	An on-CPU classification model for paraphrased and obfuscated attacks, scored 0–1 with separate monitor and block thresholds
both	The phrase list and the classifier together

Each detector can be switched off on its own, so a detector that blocks legitimate traffic can be stopped without losing the other. Classifier scores are recorded on the call; the recommended sequence is monitor, review the scores on AI → AI Activity, then block. The benchmark behind the classifier and its thresholds is in Secure60 AI Protector — Jailbreak detection.

Monitor or block

The policy’s Enforcement decides what a finding does:

• Monitor — the call goes through; the finding and the decision the policy would have made are recorded.
• Protect with prompt injection set to block — the call is refused with HTTP 403 before it reaches the model, and recorded with outcome = blocked.

In the session view on AI Activity, a prompt-injection finding shows the rule that matched and highlights the matched phrase in the message.

Detection rules

The managed pack Secure60 – Managed Rules – AI Protector includes:

Rule	Raises a threat when
AI Protector - Prompt Injection Attempt	a prompt-injection finding is recorded, in monitor or protect mode
AI Protector - Request Blocked by Guardrail	a guardrail refused a call
AI Protector - Repeated Guardrail Violations by One User	one user causes repeated violations
AI Protector - Repeated Guardrail Violations from One Address	one source address causes repeated violations

Deploy the pack to a project from Detection Rules. Threats appear under Threats with the audit events that raised them.

Setting it up

1. Route the application through a Secure60 AI Protector.
2. In its guardrail policy, set prompt injection to monitor and choose the engine.
3. Review findings on AI → AI Activity, filtering the AI Audit Trail by the JAILBREAK violation.
4. Adjust the phrase list or thresholds, then set the policy to Protect with prompt injection on block.