| ID | Threat | Status | NEOS Guard coverage |
|---|---|---|---|
| LLM01 | Prompt Injection Novel 83% / known 99% detection · 0% FP · holdout-verified | ✅ Covered | Input guard — rules + Meta Prompt Guard 2 + LLM ensemble, self-evolving |
| LLM02 | Sensitive Information Disclosure Known 100% / novel 67% deterministic detection · 0% FP | ✅ Covered | Output guard — secrets engine (gitleaks-grade) + PII engine (Presidio-lite), self-evolving |
| LLM03 | Supply Chain Honestly a different product category. NEOS Guard focuses on runtime defense | ⚪ Out of scope | Out of scope — model/dependency supply-chain integrity is SCA/SBOM territory, not a runtime guard |
| LLM04 | Data & Model Poisoning A runtime guard can't defend this. Marked honestly as not covered | ⚪ Out of scope | Out of scope — training-data/model poisoning is training-pipeline governance |
| LLM05 | Improper Output Handling Flags downstream-execution risk. Opt-in to avoid FPs for code assistants | 🟡 Partial | Dangerous-output detection (opt-in) — SQL/XSS/shell/path-traversal/exfil links in output |
| LLM06 | Excessive Agency Known 100% / novel 50% · blocks excessive actions via runtime session monitor | 🟡 Partial | Behavior guard — destructive actions, hijack execution, privilege escalation, session trajectory |
| LLM07 | System Prompt Leakage Deterministic detection of system-prompt / internal-rule disclosure · 0% FP | ✅ Covered | Output guard prompt_leak + self-learned (internal-rule / hidden-rule disclosure) |
| LLM08 | Vector & Embedding Weaknesses Honestly a different layer. Could extend to a RAG guard later | ⚪ Out of scope | Out of scope — RAG embedding / vector-DB security is retrieval-infra territory |
| LLM09 | Misinformation Not what a security guard does. Marked honestly as not covered | ⚪ Out of scope | Out of scope — hallucination/factuality is fact-check/grounding product territory |
| LLM10 | Unbounded Consumption Detects automated/DoS-style consumption patterns + per-tier rate limits | 🟡 Partial | Behavior guard (runaway loops · bot-speed) + API rate limiting |