Skip to main content
The Semantic Threat Intelligence analyzer compares the input prompt against a tenant-scoped database of known adversarial prompts using Vertex AI text embeddings and cosine similarity in pgvector. It catches paraphrases, obfuscations, and language-shifted variants of prompts the classifier has already seen — the kind of attack a syntactic classifier struggles with but a semantic compare handles trivially.

​
What it detects

Inputs that are semantically close to a prompt already in your threat-intel store. “Close” is measured as cosine similarity in the embedding space:
  • >= 0.90 — high-similarity match (effectively a paraphrase).
  • >= 0.75 — medium similarity (related themes, similar attack pattern).
  • >= 0.50 — low similarity (loosely related; usually not actionable).
Severity is reported as Low, Medium, or High derived from the similarity score.

​
How it works

  1. Embed the input with Vertex AI (text-embedding-004, 768-dimensional, optimized for semantic similarity).
  2. Query the tenant’s prompt_injections table — and optionally the public threat-intel set — for the nearest neighbour by cosine distance.
  3. Convert distance to similarity: similarity = 1.0 - distance.
  4. Map the similarity to a severity level using the configured thresholds (defaults: 0.90 / 0.75).
Customer threat-intel data is strictly tenant-scoped. The optional include_public_threat_intel parameter lets the analyzer additionally match against a curated public set; turning it off limits matches to your own ingestion.

​
Parameters

​
Outputs and metrics

​
Termination signals

Output match hints:
  • High — fires on a high-severity match.
  • Medium — fires on a medium-severity match.
Combine with a similarity_score threshold for tighter control: output_match: "High" AND similarity_score >= 0.92.

​
Limits and cost

Cost is Vertex AI embedding pricing — see the Vertex AI pricing page. Empty input short-circuits and returns a low-severity default without paying for an embedding call.

​
Typical latency

1–50 ms total. Embedding generation usually dominates (~10–25 ms); the pgvector cosine search itself is sub-millisecond.

​
Adding your own threat intel

Two paths to ingest known-bad prompts into the comparison set:
  • In the dashboard, use the Threat Workbench to triage and resolve flagged prompts. Resolved threats are written to the prompt_injections table for your tenant.
  • Programmatically, call POST /api/v1/vector/add-embedding. This writes to the generic embedding table; for adversarial signal use the workbench so the entry shows up under semantic-threat-intelligence.
You can categorize ingestions with a category and severity so termination rules can target specific severities.

​
When to use it

  • Pair with the classifier. The classifier and this analyzer cover different failure modes:
    • Classifier strong on syntactic shape, weak on novel phrasings.
    • Semantic analyzer strong on paraphrase / obfuscation, weak on truly novel attacks.
  • Inbound primarily. The threat-intel store is keyed off attack prompts, so inbound is where it earns its keep.
  • Ramp the threshold over time. Start at 0.90 (high precision); monitor false negatives in the Analysis log; drop toward 0.85 as your corpus grows.

​
Failure modes

  • Vertex AI unreachable → analyzer_unavailable 503 with Retry-After.
  • Empty threat-intel store → similarity_score = 0.0, severity_level = 0. Not an error.

​
Next