AID-H-026: Continuous Closed-Loop Hardening of Retrainable Prompt Injection Detectors

Version 1.20261015 · Family — navigation only

Continuously strengthen a retrainable prompt injection detection model through a governed, closed-loop hardening pipeline. The pipeline generates or collects adversarial prompts that evade the current detector, identifies hard samples from detector errors, reinjects those samples into subsequent training cycles, and validates candidate detector versions on an independent out-of-loop evaluation set before promotion.

Scope boundary

Owns the governed hard-sample, adversarial-corpus, coverage-analysis, retraining, and independent-promotion loop for a prompt-injection detector whose training lifecycle the organization controls. It does not perform inline runtime filtering.

AID-D-001.001: AID-H-026 improves a retrainable detector between releases; AID-D-001.001 analyzes each live prompt and emits the runtime finding. Offline detector hardening does not admit or block a production request.

AID-H-036: AID-H-026 owns the closed-loop retraining lifecycle for prompt-injection detectors; AID-H-036 owns multilingual and locale-stratified validation evidence for inbound safety classifiers before promotion. A retraining loop can consume multilingual results, but it does not replace language-segment evaluation.

Warning

Not a Standalone Runtime Security Boundary

Closed-loop retraining can overfit to mined attacks or degrade benign-input performance. Require an independent out-of-loop evaluation set, explicit regression limits, and a tested rollback path for every promoted detector version.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0015 Evade AI Model
AML.T0051 LLM Prompt Injection
AML.T0054 LLM Jailbreak
AML.T0065 LLM Prompt Crafting
AML.T0068 LLM Prompt Obfuscation
AML.T0123 Obfuscated Files or Information

MAESTRO

Adversarial Examples (L1)
Input Validation Attacks (L3)
Framework Evasion (L3)
Evasion of Detection (L5)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection

OWASP ML Top 10 2023

ML01:2023 Input Manipulation Attack

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

NISTAML.015 Indirect Prompt Injection
NISTAML.018 Prompt Injection
NISTAML.022 Evasion
NISTAML.025 Black-box Evasion

Cisco Integrated AI Security and Safety Framework

AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
AITech-1.2 Indirect Prompt Injection
AITech-9.2 Detection Evasion
AISubtech-1.1.1 Instruction Manipulation
AISubtech-1.1.2 Obfuscation
AISubtech-1.1.5 Context Manipulation

Google Secure AI Framework 2.0 - Risks

PIJ: Prompt Injection
MEV: Model Evasion

Databricks AI Security Framework 3.0

Evaluation 6.2: Insufficient evaluation data
Model Serving - Inference requests 9.1: Prompt inject
Model Serving - Inference requests 9.12: LLM Jailbreak