AI Attack Monitor: A Standards-Aligned Architecture for Monitoring and Risk Scoring of Attacks on Large Language Model Applications

Abstract

Applications built on large language models (LLMs) are exposed to attacks that bypass perimeter defenses, including direct and indirect prompt injection, jailbreaking, data and model poisoning, sensitive information disclosure and excessive agency of AI agents. Commercial AI security products have multiplied, but the market has rapidly consolidated, and organizations lack a transparent way to compare products and to build monitoring that fits their existing security operations. This paper analyzes eight AI security solutions against eight functions derived from the OWASP Top 10 for LLM Applications 2026 and MITRE ATLAS, using an ordinal 0–2 scale and a weighted scoring model. Prisma AIRS obtained the highest weighted score (88.75 of 100), followed by Cisco AI Defense and Check Point AI Security (76.25 each), while protection against data poisoning (50.0% mean coverage) and data leakage prevention (56.25%) were the weakest functions across the market. Based on these gaps, we propose AI Attack Monitor, a pipeline architecture consisting of a security gateway, detection engine, risk analyzer, alerting and dashboard, with a transparent risk-scoring model and a unified event schema mapped to OWASP and ATLAS identifiers. An evaluation plan on public benchmarks is outlined.

Keywords: AI security, large language models, prompt injection, attack monitoring, OWASP Top 10 for LLM, MITRE ATLAS, risk scoring, AI agents

References

1. Perez, F.; Ribeiro, I. Ignore Previous Prompt: Attack Techniques for Language Models. arXiv 2022, arXiv:2211.09527.
2. Greshake, K.; Abdelnabi, S.; Mishra, S.; Endres, C.; Holz, T.; Fritz, M. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec ’23), Copenhagen, Denmark, 30 November 2023; pp. 79–90.
3. OWASP GenAI Security Project. OWASP GenAI LLM Top 10 2026. Available online: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ (accessed on 10 October 2026).
4. MITRE Corporation. MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. Available online: https://atlas.mitre.org (accessed on 10 October 2026).
5. Vassilev, A.; Oprea, A.; Fordyce, A.; Anderson, H.; Davies, X.; Hamin, M. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations; NIST AI 100-2e2025; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2025.
6. Zou, W.; Geng, R.; Wang, B.; Jia, J. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. In Proceedings of the 34th USENIX Security Symposium, Seattle, WA, USA, 13–15 August 2025.
7. Debenedetti, E.; Zhang, J.; Balunović, M.; Beurer-Kellner, L.; Fischer, M.; Tramèr, F. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. In Proceedings of the Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track, Vancouver, BC, Canada, 10–15 December 2024.
8. Cisco Systems. Cisco AI Defense. Available online: https://www.cisco.com/site/us/en/products/security/ai-defense/index.html (accessed on 10 October 2026).
9. Palo Alto Networks. Prisma AIRS: AI Runtime Security. Available online: https://www.paloaltonetworks.com/ai-security/prisma-airs (accessed on 10 October 2026).
10. SentinelOne. Securing AI (Prompt Security). Available online: https://www.sentinelone.com/platform/securing-ai-prompt/ (accessed on 10 October 2026).
11. Check Point Software Technologies. Lakera: AI Security. Available online: https://www.lakera.ai (accessed on 10 October 2026).
12. Tabassi, E. Artificial Intelligence Risk Management Framework (AI RMF 1.0); NIST AI 100-1; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2023.
13. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile; NIST AI 600-1; NIST: Gaithersburg, MD, USA, 2024.
14. Google. Secure AI Framework (SAIF). Available online: https://saif.google (accessed on 10 October 2026).
15. ISO/IEC 42001:2023; Information Technology—Artificial Intelligence—Management System. International Organization for Standardization: Geneva, Switzerland, 2023.
16. Microsoft. Catalog of AI Attack Techniques. Available online: https://learn.microsoft.com/en-us/security/zero-trust/catalog-ai-attack-techniques/catalog-ai-attack-techniques (accessed on 10 October 2026).
17. Microsoft. AI Red Teaming. Available online: https://learn.microsoft.com/en-us/security/ai-red-team/ (accessed on 10 October 2026).
18. Yao, Y.; Duan, J.; Xu, K.; Cai, Y.; Sun, Z.; Zhang, Y. A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly. High-Confid. Comput. 2024, 4, 100211.
19. Liu, Y.; Deng, G.; Li, Y.; Wang, K.; Wang, Z.; Wang, X.; Zhang, T.; Liu, Y.; Wang, H.; Zheng, Y.; Liu, Y. Prompt Injection Attack against LLM-Integrated Applications. arXiv 2023, arXiv:2306.05499.
20. Yi, J.; Xie, Y.; Zhu, B.; Kiciman, E.; Sun, G.; Xie, X.; Wu, F. Benchmarking and Defending against Indirect Prompt Injection Attacks on Large Language Models. arXiv 2023, arXiv:2312.14197.
21. Liu, Y.; Jia, Y.; Geng, R.; Jia, J.; Gong, N.Z. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. In Proceedings of the 33rd USENIX Security Symposium, Philadelphia, PA, USA, 14–16 August 2024; pp. 1831–1847.
22. Wei, A.; Haghtalab, N.; Steinhardt, J. Jailbroken: How Does LLM Safety Training Fail? In Proceedings of the Advances in Neural Information Processing Systems 36 (NeurIPS 2023), New Orleans, LA, USA, 10–16 December 2023.
23. Zou, A.; Wang, Z.; Carlini, N.; Nasr, M.; Kolter, J.Z.; Fredrikson, M. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv 2023, arXiv:2307.15043.
24. Chao, P.; Robey, A.; Dobriban, E.; Hassani, H.; Pappas, G.J.; Wong, E. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv 2023, arXiv:2310.08419.
25. Carlini, N.; Tramèr, F.; Wallace, E.; Jagielski, M.; Herbert-Voss, A.; Lee, K.; Roberts, A.; Brown, T.; Song, D.; Erlingsson, Ú.; et al. Extracting Training Data from Large Language Models. In Proceedings of the 30th USENIX Security Symposium, Virtual Event, 11–13 August 2021; pp. 2633–2650.
26. Carlini, N.; Jagielski, M.; Choquette-Choo, C.A.; Paleka, D.; Pearce, W.; Anderson, H.; Terzis, A.; Thomas, K.; Tramèr, F. Poisoning Web-Scale Training Datasets is Practical. In Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, 19–23 May 2024.
27. Alon, G.; Kamfonas, M. Detecting Language Model Attacks with Perplexity. arXiv 2023, arXiv:2308.14132.
28. Jain, N.; Schwarzschild, A.; Wen, Y.; Somepalli, G.; Kirchenbauer, J.; Chiang, P.; Goldblum, M.; Saha, A.; Geiping, J.; Goldstein, T. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv 2023, arXiv:2309.00614.
29. Inan, H.; Upasani, K.; Chi, J.; Rungta, R.; Iyer, K.; Mao, Y.; Tontchev, M.; Hu, Q.; Fuller, B.; Testuggine, D.; et al. Llama Guard: LLM-Based Input-Output Safeguard for Human-AI Conversations. arXiv 2023, arXiv:2312.06674.
30. Rebedea, T.; Dinu, R.; Sreedhar, M.N.; Parisien, C.; Cohen, J. NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, Singapore, 6–10 December 2023; pp. 431–445.
31. Hines, K.; Lopez, G.; Hall, M.; Zarfati, F.; Zunger, Y.; Kiciman, E. Defending Against Indirect Prompt Injection Attacks With Spotlighting. arXiv 2024, arXiv:2403.14720.
32. Mazeika, M.; Phan, L.; Yin, X.; Zou, A.; Wang, Z.; Mu, N.; Sakhaee, E.; Li, N.; Basart, S.; Li, B.; et al. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In Proceedings of the 41st International Conference on Machine Learning (ICML 2024), Vienna, Austria, 21–27 July 2024.
33. Robust Intelligence. AI Firewall (Archived Product Page). Available online: https://www.robustintelligence.com/platform/ai-firewall (accessed on 10 October 2026).
34. HiddenLayer. Agentic Runtime Security. Available online: https://hiddenlayer.com/agents (accessed on 10 October 2026).
35. Microsoft. AI Security Best Practices on Azure. Available online: https://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices (accessed on 10 October 2026).
36. Noma Security. AI Security Platform. Available online: https://noma.security (accessed on 10 October 2026).

How to cite

Abdrasil Alisher, Altaev Amir, Sisenov Rakhat AI Attack Monitor: A Standards-Aligned Architecture for Monitoring and Risk Scoring of Attacks on Large Language Model Applications // Central Asian Scientific Journal. – 2026. – No. 4(32), Vol. 2. – Pp. 185–193.