Chapter 3: Protecting LLMs from Attacks

Is this Chapter for You?

Every attack you studied in Chapter 2 – from prompt injection to data poisoning to agentic exploitation – has a corresponding defense. Knowing the attacks is essential, but it’s only half the picture. Organizations need professionals who can translate attack knowledge into security architectures, policies, and operational controls that actually stop threats in production.

This chapter is designed for technical professionals who need to protect AI systems – not just understand what threatens them.

  • Are you a security professional, architect, or developer responsible for deploying or hardening AI-powered applications?

  • Do you need to select, configure, and validate defense controls that map to specific AI threat categories?

  • Do you want to move from “we know the risks” to “we’ve mitigated the risks” with a structured framework you can implement and communicate to leadership?

If so, this chapter will give you that defense readiness.

How is this Chapter Different?

TL;DR

The primary goal of this chapter is to build your defense readiness – understanding security frameworks and controls deeply enough to design a protection architecture, map defenses to specific attacks, and implement layered controls using industry tools. We go beyond awareness to implementation-ready knowledge.

This chapter completes the three-chapter arc: Chapter 1 gave you AI fluency (understand), Chapter 2 gave you attack fluency (identify threats), and now Chapter 3 gives you defense readiness (protect and mitigate). You’ll learn the TrendAI Security for AI Blueprint – a 6-layer defense framework – and see how each layer maps to the OWASP categories you studied in Chapter 2.

Most AI security content stops at listing risks. This chapter occupies the practical defense ground: you’ll walk through the Blueprint layers, see defense flow diagrams, study how each control addresses specific attack vectors, and understand how TrendAI Vision One integrates these layers into a unified platform.

By the end, you’ll be able to design an AI security architecture, justify each control by mapping it to a threat, and have a credible conversation about AI defense strategy with anyone from a developer to a CISO.

What You’ll Learn in This Chapter

By the end of this chapter, you will be able to:

  • Apply the 6-layer Blueprint framework: Map each layer of the Security for AI Blueprint to the threats it defends against
  • Map OWASP categories to defense controls: Connect every LLM Top 10 (2026) and Agentic AI Top 10 (2026) category to specific Blueprint layers and key controls
  • Describe TrendAI product capabilities: Explain how TrendAI Vision One, AI-SPM, ZTSA, AI Scanner, and AI Guard implement each defense layer
  • Design the AI Scanner/Guard continuous loop: Articulate how proactive scanning and runtime protection work together in a scan-protect-validate-improve cycle
  • Verify the application against OWASP AISVS: Use the 12-chapter verification standard – and the LEARN mnemonic as an index into it – to check the AI application you built
  • Build an AI security culture: Establish red-teaming practices, incident response procedures, and compliance alignment for AI systems

Master OWASP-to-Blueprint Mapping

Before diving into the Blueprint layers, here is the big picture: how every OWASP vulnerability category maps to the defense framework you’ll learn in this chapter. These two tables – covering all 10 LLM Top 10 (2026) categories and all 10 Agentic AI Top 10 (2026) categories – are your reference throughout the chapter. They show which Blueprint layers and controls address each threat.

How to Use These Tables

Each row connects an OWASP attack category (from Chapter 2) to one or more Blueprint defense layers (covered in Sections 3-8). The “Key Controls” column lists specific capabilities you’ll learn about in the corresponding section. Use these tables to:

  • Find the defense for a specific threat: If a stakeholder asks “how do we protect against prompt injection?” – find LLM01, see it maps to Layer 5 and Layer 6, and turn to Sections 7 and 8 for implementation details.
  • Validate coverage: Walk the table to ensure your security architecture addresses all 20 OWASP categories.
  • Communicate to leadership: These tables translate technical vulnerabilities into defense investments – a language that CISOs and boards understand.

OWASP LLM Top 10 (2026) to Blueprint Layers

OWASP Category Primary Defense Layer(s) Key Controls
LLM01: Prompt Injection Layer 5 (Access), Layer 6 (Zero-Day) Prompt filtering (ZTSA), restricted tool use on untrusted turns, behavioral anomaly detection
LLM02: Sensitive Information Disclosure Layer 1 (Data), Layer 5 (Access) Data classification (DSPM), response filtering (AI Guard), DLP controls
LLM03: Excessive Agency Layer 3 (Infrastructure), Layer 5 (Access), Layer 4 (Users) Credential scoping and tool allowlists (AI-SPM), server-side action scope (ZTSA), human gate on irreversible actions
LLM04: Supply Chain Layer 2 (Models), Layer 3 (Infrastructure) Container security, vulnerability scanning, model integrity verification, AI-SPM
LLM05: Data and Model Poisoning Layer 1 (Data), Layer 2 (Models) Data lineage, integrity verification, AI Scanner pre-deployment scanning
LLM06: Unbounded Consumption Layer 5 (Access), Layer 6 (Zero-Day) Rate limiting (ZTSA), anomaly detection (IDS/IPS), cost monitoring
LLM07: Misinformation Layer 4 (Users), Layer 5 (Access) Output validation (AI Guard), human-in-the-loop policies, grounding verification
LLM08: Hidden Context Exposure Layer 5 (Access) Prompt/response filtering, AI Guard leakage detection, instruction hardening
LLM09: Vector and Embedding Weaknesses Layer 1 (Data), Layer 3 (Infrastructure) Vector store access controls, DSPM for RAG corpora, infrastructure posture
LLM10: Improper Output Handling Layer 5 (Access), Layer 6 (Zero-Day) Response filtering (AI Guard), output validation, virtual patching

OWASP Agentic AI Top 10 (2026) to Blueprint Layers

OWASP Category Primary Defense Layer(s) Key Controls
WarningASI01: Agent Goal Hijacking Layer 5 (Access), Layer 6 (Zero-Day) Prompt filtering, behavioral monitoring, instruction anchoring
WarningASI02: Tool Misuse and Exploitation Layer 3 (Infrastructure), Layer 5 (Access) Tool allowlisting, execution monitoring (AI-SPM), ZTSA enforcement
WarningASI03: Identity and Privilege Abuse Layer 3 (Infrastructure), Layer 4 (Users) Least-privilege enforcement, identity management, access auditing
WarningASI04: Agentic Supply Chain Layer 2 (Models), Layer 3 (Infrastructure) MCP server verification, container scanning, dependency auditing
WarningASI05: Unexpected Code Execution Layer 3 (Infrastructure), Layer 6 (Zero-Day) Sandboxing, execution monitoring, virtual patching
WarningASI06: Memory and Context Poisoning Layer 1 (Data), Layer 5 (Access) Memory store access controls, context validation, input filtering
WarningASI07: Insecure Inter-Agent Communication Layer 3 (Infrastructure), Layer 5 (Access) Communication channel security, message validation, ZTSA
WarningASI08: Cascading Failures Layer 3 (Infrastructure), Layer 6 (Zero-Day) Blast radius containment, circuit breakers, anomaly detection
WarningASI09: Human-Agent Trust Exploitation Layer 4 (Users) Gate the irreversible subset, confidence calibration, rotate or sample verification (no detector exists)
WarningASI10: Rogue Agents Layer 3 (Infrastructure), Layer 4 (Users) Shadow AI discovery including local runtimes, a named owner per agent, credential inventory

Chapter Topics: Building Your AI Defense Architecture

Here’s what we’ll cover in this chapter:

​

  1. Integrating Security into AI Architectures – DevSecOps for AI, threat modeling for LLM deployments, and the shared responsibility model that connects attack knowledge to defense strategy

  2. Security for AI Blueprint Overview – The complete 6-layer defense framework with defense-in-depth principles, layer interrelationships, and TrendAI Vision One as the unifying platform

  1. Layer 1: Secure Your Data – DSPM, data classification, vector store security, RAG corpus protection, and data lineage tracking

  2. Layer 2: Secure Your AI Models – Container security, vulnerability scanning, model integrity verification, and artifact signing

  3. Layer 3: Secure Your AI Infrastructure – AI-SPM, posture management, misconfiguration detection, and risk insights

  4. Layer 4: Secure Your Users – Deepfake detection, endpoint security, shadow AI discovery, and user behavior analytics

  5. Layer 5: Secure Access to AI Services – AI Gateway, Zero Trust Secure Access, prompt and response filtering, and rate limiting

  6. Layer 6: Defend Against Zero-Day Exploits – Network IDS/IPS, virtual patching, behavioral anomaly detection, and zero-day threat intelligence

  1. The AI Application Security Continuous Loop – AI Scanner for proactive assessment and AI Guard for runtime protection, working together in a scan-protect-validate-improve cycle, anchored to ATLAS AML.M0035

  2. Verifying AI Applications: AISVS and LEARN – OWASP’s application-level verification standard (12 chapters, 191 testable requirements, 3 levels), with the LEARN mnemonic as the recall index into it

  1. Building an AI Security Culture – Red-teaming under ATLAS AML.M0035 and the OWASP GenAI Red Teaming Guide, AI incident response after NIST SP 800-61r3, the NIST Generative AI Profile, both EU AI Act regimes with their current dates, and who inside the organization actually owns each practice
Defense by Doing

Each section in this chapter includes:

  • Defense flow diagrams: Mermaid visualizations showing how each control intercepts and mitigates specific attack vectors
  • Breach-to-defense narratives: Chapter 2’s real-world case studies revisited through the lens of “what would have stopped this?”
  • OWASP-to-Blueprint mapping callouts: Inline cross-references connecting each defense to the specific attacks it addresses
  • Interactive quizzes: Test your understanding of defense frameworks, Blueprint layers, and product capabilities

These elements are designed to build implementation-ready knowledge you can use when designing and evaluating AI security architectures.

Chapter 3 at a Glance

Sections Focus Key Output
S1-S2 (Foundation) Security architecture principles, the 6-layer Blueprint framework Understanding of how defenses are organized and why defense-in-depth works
S3-S8 (Blueprint Layers) Deep dives into each of the six layers, with TrendAI product mappings Layer-by-layer defense controls mapped to specific OWASP attack categories
S9-S10 (Advanced) AI Scanner/Guard continuous loop and OWASP AISVS verification Proactive scanning + runtime protection workflow, then a testable standard to hold the application to
S11 (Culture) Red-teaming, incident response, compliance (NIST AI RMF, EU AI Act) Organizational practices that sustain AI security beyond individual controls

The eleven sections are not the same size

The layers are presented as siblings because they are peers in the architecture. They are not peers in reading time, and a reader planning their week deserves to know that before starting. Chapter 3 runs roughly six hours end to end, distributed like this:

Section Approx. reading Section Approx. reading
S1 Integrating Security 15 min S7 Layer 5: Access 50 min
S2 Blueprint Overview 20 min S8 Layer 6: Zero-Day 40 min
S3 Layer 1: Data 30 min S9 Continuous Loop 30 min
S4 Layer 2: Models 35 min S10 AISVS Verification 25 min
S5 Layer 3: Infrastructure 40 min S11 Security Culture 35 min
S6 Layer 4: Users 35 min

S7 is the outlier, and deliberately so. Layer 5 is the only layer that sits in the request path in both directions, so it is the layer most of the others hand their runtime enforcement to – it carries roughly twice the cross-references of any other section. It is broad rather than padded: per OWASP category it is the second leanest section in the chapter. If your time is limited, S2 and S7 are the two that repay reading in full.

Learning Progression

This chapter completes the course arc: Chapter 1 gave you AI fluency, Chapter 2 gave you attack fluency, and now Chapter 3 gives you defense readiness. Return to earlier chapters anytime to reinforce the connections.

Ready to build the defenses that match the attacks you studied in Chapter 2?

Start with Section 1: Integrating Security into AI Architectures