Search K
Appearance
Glossary
These terms are unique to F5 AI Security. For related terms, see the F5 Glossary.
Agent attack prompts
Single-turn attacks that the AI Security Red Team agent creates dynamically based on your custom intent. The agent uses signature attack vectors and converters to generate these attacks.
See also: Signature attack
Agentic resistance
An attack where the AI Security Red Team agent creates and sends prompts on its own based on your defined malicious intent.
See also: Multi-turn
AI Guardrails
The AI Security product for creating and using guardrails to secure applications and LLMs against threats such as prompt injection, jailbreaking, and data exfiltration.
See also: Guardrails, AI Red Team
AI Red Team
The AI Security product for creating and running attack campaigns to find LLM vulnerabilities and test security posture.
See also: AI Guardrails
AI Security Platform
The overall F5 AI Security system that encompasses both AI Guardrails and AI Red Team products, providing comprehensive protection and testing capabilities for AI systems.
See also: AI Guardrails, AI Red Team
Crescendo
An agentic resistance attack vector. It gradually escalates prompts over multiple turns. It starts with benign requests and progressively increases the intensity or sensitivity of the requests to extract restricted information.
See also: Agentic resistance
Custom guardrail
A custom guardrail is a user-created, real-time policy for monitoring and intercepting traffic coming in and out of LLMs and applications. You can tailor custom guardrails for your use cases.
Types
| Type | Description |
|---|---|
| Custom GenAI scanners | Use AI-generated definitions for detection |
| Regex scanners | Use regular expressions to identify patterns |
| Keyword scanners | Use specific keywords to flag content |
See also: Guardrails
DAN (do anything now)
A signature attack vector designed to bypass LLM restrictions by causing the model to ignore its safety guidelines and respond to any request.
See also: Signature attack
Default guardrail
Out-of-the-box guardrails packages provided by AI Security to protect against the most common risks. Default guardrails are created by the AI Security research team and regularly updated.
See also: Guardrail package, Guardrails
Fictional context change
An attack that places the LLM into a fictional scenario. Example scenarios include a movie plot, a game, or a story. The intent is to trick your LLM to generate restricted or harmful outputs as part of the narrative.
See also: Signature attack
Fingerprint
Use an AI Security fingerprint to:
- View system prompts: See the prompts given to the agent, including built-in prompts from providers such as Anthropic Claude Code. These prompts may include guidance on prompt-injection awareness and OWASP references.
- Inspect the action sequence: Review the full sequence of actions in a session, including tool usage such as bash commands and web searches, and how the agent progressed through a task.
- Audit agent behavior: Identify and investigate concerning activity. For example, if an agent explores directories through bash, the fingerprint lets you see exactly what the agent did.
Fingerprints are tied to session IDs. Session IDs exist only for agent projects, not for apps.
A fingerprint is a generated artifact tied to an agent session — a single interaction between a user and an AI agent. It gives you visibility into what the agent did during that session.
See also: Session ID
Fuzzing
An operational attack that sends a large volume of unusual, random, or malformed inputs to detect unexpected LLM behavior. Examples include generating incorrect answers, revealing sensitive information, or crashing.
See also: Operational attack
GenAI guardrail
A custom guardrail that uses generative artificial intelligence to scan and flag text based on configurable input. For example, you can configure a GenAI guardrail to flag any text containing political figures.
See also: Custom guardrail, Guardrails
Guardrails
A real-time policy for monitoring and intercepting traffic coming in and out of LLMs and applications. Guardrails act as detection rules that identify undesirable content based on keywords, regular expressions, AI-generated definitions, or proprietary scanning models.
The system that configures and uses guardrails is known as F5 AI Guardrails, or AI Guardrails for short.
See also: Guardrails package, Guardrails version, Custom guardrail
Guardrails package
A collection of related guardrails created by the AI Security research team to protect against common risks associated with AI systems. Guardrails packages are regularly updated to address emerging threats.
See also: Default guardrail, Guardrails
Keyword guardrails
A custom guardrail that flags text containing specific configured keywords. Keyword guardrails are useful for detecting exact terms or phrases.
See also: Custom guardrail, Guardrails
Multi-turn
Attacks that attempt to extract information or achieve a goal through multiple iterative attempts rather than a single prompt. Multi-turn attacks learn from each response and adjust subsequent prompts accordingly.
See also: Agentic resistance, Crescendo
Operational attack
Traditional application security attacks redesigned for AI systems. Examples include fuzzing (sending unusual inputs) and TLS configuration checks. Operational attacks test the robustness and security posture of LLM deployments.
See also: Signature attack, Fuzzing, TLS
Prompt log
A record of prompts sent to LLMs. Prompt logs include the prompt content, scanning results, provider information, and timestamps, enabling auditing and analysis of LLM interactions.
Regex guardrail
A custom guardrail that uses regular expressions to flag text matching configured patterns. Regex guardrails are most useful for finding input that follows predictable patterns, such as email addresses, phone numbers, or URLs.
See also: Custom guardrail, Guardrails
Session ID
A session ID is a unique identifier assigned to each agent session. F5 AI Security uses the session ID to associate a fingerprint with the correct session. This can help you trace what a specific agent did during a specific interaction.
Session IDs exist only for agent projects, not apps.
Signature attack
Curated attacks that have been selected and evaluated. Signature attacks may be updated frequently. They represent known attack patterns that have proven effective against LLMs. Examples include conditional context changes and fictional context changes.
See also: Operational attack