AI Security
Search K

Appearance

Glossary ​

These terms are unique to F5 AI Security. For related terms, see the F5 Glossary.

Agent attack prompts ​

Single-turn attacks that the AI Security Red Team agent creates dynamically based on your custom intent. The agent uses signature attack vectors and converters to generate these attacks.

See also: Signature attack

Agentic resistance ​

An attack where the AI Security Red Team agent creates and sends prompts on its own based on your defined malicious intent.

See also: Multi-turn

AI Guardrails ​

The AI Security product for creating and using guardrails to secure applications and LLMs against threats such as prompt injection, jailbreaking, and data exfiltration.

See also: Guardrails, AI Red Team

AI Red Team ​

The AI Security product for creating and running attack campaigns to find LLM vulnerabilities and test security posture.

See also: AI Guardrails

AI Remediate ​

The AI Security capability that automatically fixes AI model outputs flagged during Red Team testing, closing the loop between detection and mitigation.

See also: AI Red Team

AI Security Platform ​

The overall F5 AI Security system that encompasses AI Guardrails, AI Red Team, and AI Remediate, provides comprehensive protection, testing, and remediation capabilities for AI systems.

See also: AI Guardrails, AI Red Team, AI Remediate

Crescendo ​

An agentic resistance attack vector. It gradually escalates prompts over multiple turns. It starts with benign requests and progressively increases the intensity or sensitivity of the requests to extract restricted information.

See also: Agentic resistance

Custom guardrail ​

A custom guardrail is a user-created, real-time policy for monitoring and intercepting traffic coming in and out of LLMs and applications. You can tailor custom guardrails for your use cases.

Types ​

TypeDescription
Custom GenAI scannersUse AI-generated definitions for detection
Regex scannersUse regular expressions to identify patterns
Keyword scannersUse specific keywords to flag content

See also: Guardrails

DAN (do anything now) ​

A signature attack vector designed to bypass LLM restrictions by causing the model to ignore its safety guidelines and respond to any request.

See also: Signature attack

Default guardrail ​

Out-of-the-box guardrails packages provided by AI Security to protect against the most common risks. Default guardrails are created by the AI Security research team and regularly updated.

See also: Guardrail package, Guardrails

Fictional context change ​

An attack that places the LLM into a fictional scenario. Example scenarios include a movie plot, a game, or a story. The intent is to trick your LLM to generate restricted or harmful outputs as part of the narrative.

See also: Signature attack

Fingerprint ​

Use an AI Security fingerprint to:

  • View system prompts: See the prompts given to the agent, including built-in prompts from providers such as Anthropic Claude Code. These prompts may include guidance on prompt-injection awareness and OWASP references.
  • Inspect the action sequence: Review the full sequence of actions in a session, including tool usage such as bash commands and web searches, and how the agent progressed through a task.
  • Audit agent behavior: Identify and investigate concerning activity. For example, if an agent explores directories through bash, the fingerprint lets you see exactly what the agent did.

Fingerprints are tied to session IDs. Session IDs exist only for agent projects, not for apps.

A fingerprint is a generated artifact tied to an agent session — a single interaction between a user and an AI agent. It gives you visibility into what the agent did during that session.

See also: Session ID

F1 score ​

A measure of how accurately a set of guardrails separates attacks from benign prompts. F1 combines precision (how many flagged prompts were real attacks) and recall (how many attacks were flagged) into one score from 0 to 1, often shown as a percentage. A high F1 score means few missed attacks and few false alarms. AI Remediate uses F1 to evaluate the guardrail packages it generates.

See also: AI Remediate

Fuzzing ​

An operational attack that sends a large volume of unusual, random, or malformed inputs to detect unexpected LLM behavior. Examples include generating incorrect answers, revealing sensitive information, or crashing.

See also: Operational attack

GenAI guardrail ​

A custom guardrail that uses generative artificial intelligence to scan and flag text based on configurable input. For example, you can configure a GenAI guardrail to flag any text containing political figures.

See also: Custom guardrail, Guardrails

Guardrails ​

A real-time policy for monitoring and intercepting traffic coming in and out of LLMs and applications. Guardrails act as detection rules that identify undesirable content based on keywords, regular expressions, AI-generated definitions, or proprietary scanning models.

The system that configures and uses guardrails is known as F5 AI Guardrails, or AI Guardrails for short.

See also: Guardrails package, Guardrails version, Custom guardrail

Guardrails package ​

A collection of related guardrails created by the AI Security research team to protect against common risks associated with AI systems. Guardrails packages are regularly updated to address emerging threats.

See also: Default guardrail, Guardrails

Intent ​

The goal you define for a Red Team attack, such as getting the model to reveal restricted information. The Red Team agent uses your intent, along with attack vectors and converters, to dynamically generate attack prompts. For more information, see Intents.

See also: Agent attack prompts, Agentic resistance

Keyword guardrails ​

A custom guardrail that flags text containing specific configured keywords. Keyword guardrails are useful for detecting exact terms or phrases.

See also: Custom guardrail, Guardrails

Multi-turn ​

Attacks that attempt to extract information or achieve a goal through multiple iterative attempts rather than a single prompt. Multi-turn attacks learn from each response and adjust subsequent prompts accordingly.

See also: Agentic resistance, Crescendo

Operational attack ​

Traditional application security attacks redesigned for AI systems. Examples include fuzzing (sending unusual inputs) and TLS configuration checks. Operational attacks test the robustness and security posture of LLM deployments.

See also: Signature attack, Fuzzing, TLS

Prompt log ​

A record of prompts sent to LLMs. Prompt logs include the prompt content, scanning results, provider information, and timestamps, enabling auditing and analysis of LLM interactions.

Regex guardrail ​

A custom guardrail that uses regular expressions to flag text matching configured patterns. Regex guardrails are most useful for finding input that follows predictable patterns, such as email addresses, phone numbers, or URLs.

See also: Custom guardrail, Guardrails

Session ID ​

A session ID is a unique identifier assigned to each agent session. F5 AI Security uses the session ID to associate a fingerprint with the correct session. This can help you trace what a specific agent did during a specific interaction.

Session IDs exist only for agent projects, not apps.

Signature attack ​

Curated attacks that have been selected and evaluated. Signature attacks may be updated frequently. They represent known attack patterns that have proven effective against LLMs. Examples include conditional context changes and fictional context changes.

See also: Operational attack

Updated at: