SECAI Core · phase 13 of 15
Signature matching
A technique in which predefined patterns are used to identify malicious activity.
The Explain card
- Plain English
- Signature matching identifies malicious activity by comparing observed data against a library of predefined patterns, such as byte sequences, hashes or strings.
- Example
- A prompt filter holds a list of known jailbreak phrasings. When a user submits a prompt containing one of them, the filter blocks it before the model ever sees it.
- Why it matters
- Signatures are fast, cheap and precise for known threats, which makes them the first line of defence. But they only catch what has been seen before, so attackers rephrase and slip past. Pair them with behavioural detection.
- Hook
- A wanted poster only works if the face has not changed.
Where it sits in the deck
Phase 13: Detection, Monitoring, and Threat Intelligence
Defences eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.
