Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Detection and Alerting
Custom rules for AI attack patterns
Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.
OWASP AISVS v1.01, requirement 12.2.3
In plain English
Write detection rules for attacks that are specific to AI: coordinated jailbreak campaigns, prompt injection and attempts to extract the system prompt. Generic security rules were written for other threats and will not catch them.
What good looks like
- Custom rules cover coordinated jailbreak attempts, prompt injection and system prompt extraction at least.
- Each rule has test cases and is run against them when changed.
- Rules are reviewed as attack techniques change.
- Alerts are reviewed by people who understand AI attacks.
How teams usually do it
- SIEM rules written against the AI log schema, for example the same unusual prompt arriving from many accounts within an hour.
- Canary strings in the system prompt, with a rule that alerts whenever one appears in output.
- Mapping rules to MITRE ATLAS techniques to see what is not covered.
Suggested evidence
- Rule definitions.
- Test results for each rule.
- An example alert and investigation.
Common mistakes
- Relying on generic security rules that know nothing about AI.
- Rules written once at launch and never revisited.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.