PAPA key terms

An attack where text hidden in user input or retrieved content tricks a language model into ignoring its instructions and executing the attacker's intent instead.

Malicious instructions planted in content the model later ingests, such as web pages, documents, or emails, so the payload arrives without the user typing it.

Crafting prompts that bypass a model's safety alignment so it produces prohibited content, often by role-play framing, encoding tricks, or multi-turn escalation.

Corrupting training or fine-tuning data so a model learns biased, backdoored, or unsafe behavior that later surfaces during normal use.

A specific phrase or pattern implanted during training that causes a model to behave maliciously only when the trigger appears, evading routine testing.

Querying a deployed model systematically to reconstruct a functionally similar copy or infer its parameters, stealing intellectual property and enabling cheaper attacks.

Reconstructing sensitive training data, such as faces or personal records, by repeatedly probing a model's outputs and confidence scores.

Determining whether a specific record was part of a model's training set, which can confirm sensitive facts like a person's diagnosis or enrollment.

A model reproducing verbatim or near-verbatim sensitive content from its training corpus when prompted or through ordinary generation.

Adding calibrated noise during training or querying so outputs reveal little about any single individual, with a measurable privacy budget.

Input and output filters, policy checks, and moderation layers that constrain what a model accepts and returns before responses reach users or downstream systems.

Requiring a person to approve consequential model actions, such as payments, code merges, or record changes, before the system executes them.

Granting an AI system more permissions, tools, or autonomy than its task requires, so a manipulated model can cause disproportionate damage.

Systems where a model plans and executes multi-step actions using tools, memory, and external APIs with limited human supervision between steps.

Tampering with tools, plugins, or function descriptions an AI agent can call so the model invokes malicious behavior or leaks data through them.

The chain of datasets, pretrained weights, libraries, and hosting services behind a model, each a potential point of tampering or compromise.

A short document describing a model's intended use, training data, evaluation results, and known limitations to support informed and safe deployment decisions.

Adversarial testing that deliberately probes a system for weaknesses, including prompt attacks and misuse cases, before attackers find them in production.

An architecture that fetches external documents at query time and supplies them to a model, improving accuracy while widening the attack surface for injected content.

Recording where data came from, who handled it, and how it changed, so trustworthiness and licensing can be verified throughout its lifecycle.

A security model that verifies every request regardless of network location, treating internal networks as untrusted and enforcing least privilege per session.

Dividing a network into small zones with granular allow rules so lateral movement from one compromised host is contained to a narrow segment.

Techniques an intruder uses to move from an initially compromised system to other hosts and accounts, escalating access toward high-value targets.

Granting identities and services only the permissions needed for their current task, and no more, to limit the blast radius of compromise or misuse.

Gaining permissions beyond those originally assigned, either by exploiting a flaw in the same account or by moving to a more privileged identity.

A trusted service that authenticates users and issues assertions or tokens, centralizing login and enabling single sign-on across applications.

A signed XML statement from an identity provider asserting a user's identity and attributes, consumed by a service provider to authorize access.

Requiring two or more independent evidence types, such as a password plus a hardware key, so a stolen password alone cannot grant access.

Methods bound to the legitimate site's origin, such as passkeys or hardware security keys, that refuse to release credentials to lookalike domains.

Automated login attempts using username and password pairs leaked elsewhere, exploiting people who reuse the same password across services.

Capping how many requests a client may make in a time window, blunting brute force, credential stuffing, scraping, and model extraction attempts.

A reverse proxy that inspects HTTP traffic against rule sets to block common injection, cross-site scripting, and bot attacks before they reach applications.

Inserting crafted SQL through unsanitized input so the database executes attacker-controlled queries, potentially exposing or altering stored records.

Injecting script into pages other users view, letting an attacker act in the victim's browser session and steal tokens or data.

Checking that data matches expected type, length, and format before processing it, rejecting malformed or hostile values at trust boundaries.

Observable artifacts such as malicious hashes, domains, or registry keys that suggest a system has been breached and can drive detection rules.

A platform that centralizes logs from many sources, correlates events, and alerts analysts to suspicious patterns across the environment.

Tooling that automates response playbooks, such as enriching alerts and isolating hosts, reducing repetitive analyst work during incidents.

A documented, repeatable sequence of steps for handling a specific alert type, defining who does what and when.

The phases of handling a security incident: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

A documented record of who handled evidence, when, and how, preserving its integrity for disciplinary, legal, or regulatory proceedings.

A bit-for-bit copy of a disk or memory volume taken before analysis so original evidence stays unaltered and findings remain reproducible.

How long log data is kept and protected from tampering, balancing investigation and compliance needs against storage cost and privacy limits.

The average elapsed time between an intrusion starting and defenders noticing it, a key measure of monitoring effectiveness.

The average time from alert or detection to containment or resolution, reflecting how quickly an organization limits damage.

Curated information about adversaries, their tools, and infrastructure that helps teams prioritize defenses and recognize activity in their own telemetry.

A public knowledge base of adversary tactics and techniques observed in real intrusions, used to structure detection coverage and threat modeling.

The division of security duties between a cloud provider and its customer, varying by service type so each party knows what it must secure.

Incorrectly set cloud settings, such as public storage buckets or permissive security groups, that expose resources without any software vulnerability.

Managing cloud resources through versioned declarative files so environments are reproducible, reviewable, and auditable rather than hand-built.

A machine-readable inventory of components and dependencies in a build, enabling fast identification of affected systems when a vulnerability is disclosed.

Continuously discovering, prioritizing, and remediating weaknesses based on exploitability and business impact rather than raw severity scores alone.

Storing API keys, tokens, and passwords in a dedicated vault with rotation and scoped access so they never live in code or configuration files.

Continuously scanning cloud environments against benchmarks and policy to surface drift, misconfigurations, and risky permissions before attackers exploit them.