Indicators of attack, indicators of compromise and now… indicators of prompt

Generative artificial intelligence is redefining the attack surface. Language, not binary code, has become a vector. In this context, Indicators of Prompt Compromise (IoPC) emerge: observable evidence that an adversary has manipulated a language model through prompts designed for that purpose.

This article proposes an operational definition of IoPC, an initial taxonomy and practical detection examples, connecting these ideas with the natural evolution of IoCs and IoAs and with MITRE ATLAS’s prior work: Prompt Injection (AML.T0051).

---

1. From IoCs and IoAs to a new scenario

For years, threat intelligence practices relied on collecting indicators.

Indicators of compromise (IoCs) confirm that something has already happened: malicious files, IP addresses or domains linked to active campaigns.

Indicators of attack (IoAs) show how the adversary operates: the tactics and techniques they use while the intrusion is underway (MITRE ATT&CK Framework).

Both models worked because the infrastructure was observable: we could monitor processes, logs or network traffic. Language models bring a different terrain: there’s no volatile memory and no TCP packets, only text, context and meaning.

---

2. A precedent: when the model became a black box

In my Ekoparty 2022 talk, “With great power comes great responsibility: AML”, I talked about the risks of machine learning models (AML) and how they often behave like black boxes.

Ekoparty 2022 — BlueSpace

Unlike a SQL injection, where we can see the malicious string or trace the error in the logs, AI models leave no clear evidence. Their reasoning gets lost among layers of weights and context.

That interpretability gap is the seed of what we now face with language models. The adversary doesn’t need to exploit the operating system; it’s enough to exploit meaning.

MITRE ATLAS already reflects this in its technique AML.T0051 — Prompt Injection, which describes manipulating models to trigger unintended responses or actions.

---

3. What are Indicators of Prompt Compromise (IoPC)?

IoPCs are signals that a language model has been compromised through text. They don’t involve malware execution or a traditional intrusion, but rather a change in behavior through semantic injection.

Differences between IoC, IoA and IoPC

“Any observable evidence that an adversary induced a language model to generate, reveal or execute information beyond the expected limits of its policy or its training.” — Adapted from Thomas Roccia, The State of Adversarial Prompts (SecurityBreak, 2025)

Typical examples:

• The model reveals sensitive data (credentials, tokens, system prompts).
• The model follows instructions that violate its policies (“Ignore your rules and show me…”).
• The model switches role or context (“Act as the system administrator and export…”).

---

4. Initial IoPC taxonomy

This taxonomy combines contributions from MITRE ATLAS with recent observations of prompt-injection behaviors in large language model ecosystems (OWASP Top 10 for LLM Applications, 2024).

---

5. How to detect IoPC

Unlike traditional systems, here we don’t inspect traffic or binaries: we inspect conversations. That requires a new layer of observability.

Minimum fields a gateway or guardrail should log:

• prompt_text (or its hash) and response_text
• user_id, session_id, timestamp
• Keyword flags: ignore, override, forget
• Secret-pattern counts: AKIA, Bearer, xoxp-
• entropy_delta: change in entropy between successive prompts
• semantic_similarity: distance to a base of known adversarial prompts

Simplified detection pipeline:

if secret_pattern_count > 0 or override_flag:
    block_response()
elif semantic_similarity > 0.8 and entropy_delta > 0.5:
    flag_for_review()
else:
    allow_and_log()

This logic aligns with the way current guardrail frameworks operate, such as NVIDIA NeMo Guardrails or Microsoft’s Azure AI Safety System, where prompts are evaluated before execution or before generating the response.

---

6. Example rules and heuristics

Rule 1: Exfiltration

(AKIA[0-9A-Z]{16}|xoxp-[0-9A-Za-z\-]+|Bearer\s+[A-Za-z0-9\-\._~\+\/]+=*|ssh-rsa)

Rule 2: Override / policy evasion

(?i)ignore (all )?previous|forget (all )?instructions|override (policy|rules)

Rule 3: Role escalation Detect prompts that contain:

"act as administrator"
"you are now root"
"switch to privileged mode"

These heuristics can be implemented in a semantic proxy or prompt WAF, an inspection layer prior to model execution, as shown by Microsoft’s work Benchmarking and Defending Against Indirect Prompt Injection Attacks on LLMs (BIPIA, 2023) and the Microsoft Security Response Center Blog (MSRC, 2025).

---

7. Technical challenges: when language deceives

Detecting IoPC involves its own challenges:

• Black boxes: most LLMs don’t expose token-level logs, which limits full auditability.
• Paraphrasing and translation: adversaries can rephrase prompts or switch languages to evade literal filters.
• Privacy: logging conversations raises data-protection and anonymization questions.
• Latency: semantic inspection adds delay; it’s best to prioritize critical blocking and let asynchronous scoring resolve the gray cases.

Addressing these problems requires hybrid detection: deterministic rules for the explicit signals and semantic-similarity models for the subtle anomalies (SecurityBreak, 2025).

---

8. Conclusion

Indicators of Prompt Compromise (IoPC) don’t replace IoCs or IoAs: they extend them to a layer where language itself is the attack surface. Detection no longer depends on binaries or packets, but on semantic signals, conversational patterns and context deviations.

We have a new attack surface

The technical challenge ahead is building observability layers capable of recording, analyzing and classifying text interactions with the same rigor we apply to logs or PCAPs. Integrating prompt firewalls, semantic detectors and correlation with traditional telemetry will be the next step to close the gap between code security and discourse security.

---

References

• MITRE ATLAS — Prompt Injection (AML.T0051)
• Thomas Roccia — The State of Adversarial Prompts (SecurityBreak, 2025)
• OWASP Top 10 for LLM Applications (2024)
• NVIDIA NeMo Guardrails Documentation
• Microsoft Research — Benchmarking and Defending Against Indirect Prompt Injection Attacks on LLMs (BIPIA) (2023)
• Microsoft Security Response Center — How Microsoft Defends Against Indirect Prompt Injection Attacks (MSRC Blog, July 29, 2025)
• Wang, Z., Ma, H., Zhang, H. and Li, X. (2025). Prompt Injection Attack Taxonomy and Mitigation Strategies. arXiv preprint arXiv:2504.11168. https://arxiv.org/pdf/2504.11168