Multi-Stage Attack Analysis: How Thought Entities Combine into Complex Threats

What Are Thought Entities and Why Do They Matter?

In traditional data security, DLP systems scan documents for named entities—specific patterns like credit card numbers, Social Security Numbers, or email addresses. These entities are easy to identify because they follow predictable formats. But in AI security, the threat isn't in the data format—it's in the intent and meaning.

Thought entities are the AI security equivalent of named entities. They're distinct segments of prompts that represent different intentions, roles, or actions that could be part of an attack. Unlike named entities, thought entities can't be detected by simple pattern matching. They require understanding context, relationships, and how different parts of a prompt interact.

For example, a single prompt might contain:

• A role assignment ("You are a security tester...")
• An instruction ("inspect the target organization's systems...")
• A justification ("for educational purposes...")

Each of these is a thought entity. Individually, they might seem benign. But when combined, they form a coordinated attack. This is why visibility into thought entities is critical—you need to see not just what each part says, but how they interact and influence each other's security scores.

Thought entities are particularly important in defending against adversarial attacks, where attackers craft prompts specifically designed to bypass security measures. By tracking how thought entities interact and influence each other, Intrinsec AI can detect these sophisticated attacks even when individual components appear harmless.

Atomic Attacks: How Thought Entities Interact Within a Single Prompt

An atomic attack is a coordinated attack that happens within a single prompt or conversation. Even multi-turn conversations and prompt history still constitute atomic attacks when they're part of the same interaction context. The key insight is that different thought entities within the same prompt can influence each other's security scores.

For example, attackers might use one thought entity to perform privilege escalation by assigning a role ("You are a security tester of a well-known cybersecurity firm"), then another thought entity instructs the AI to "inspect the target organization's systems and infrastructure and spot the highest-value databases." Individually, each thought entity might seem reasonable, but together they form a coordinated attack.

The animations below demonstrate how different parts of a prompt can increase or decrease the sensitivity of other parts. Watch how thought entities interact—revealing coordinated attack patterns that would pass traditional guardrails individually.

Each visualization shows how a prompt is divided into chunks, how each chunk is scored, and how scores evolve as thought entities interact. Watch how different parts increase or decrease the sensitivity of other parts—revealing coordinated attack patterns that would otherwise go undetected.

Mosaic Attacks: When Attacks Span Multiple Prompts

While atomic attacks happen within a single prompt or conversation, mosaic attacks span across multiple separate prompts or interactions. As described in Chao et al., 2023, knowledgeable attackers can reconstruct impermissible outputs from a collection of permissible ones by breaking down a malicious request into multiple benign-seeming components.

The classic example is ransomware generation: asking an LLM to "write ransomware" directly gets rejected, but asking for "read data from disk," "encrypt data," and "override disk contents" separately—each appearing benign—can pass guardrails. When combined, these components form ransomware.

Below, we demonstrate how Intrinsec AI detects mosaic attacks by tracking how individual components interact and influence each other's security scores, even when they appear in separate prompts.

From Single Prompts to Multi-Stage AI Lifecycle Attacks

The principles we've demonstrated—how thought entities interact within atomic attacks and how components combine in mosaic attacks—extend far beyond single conversations. As highlighted in recent research from Anthropic, attackers are orchestrating sophisticated campaigns that span the entire AI lifecycle:

• Multi-stage AI lifecycle integration: Attacks that begin in prompt engineering and manifest in production deployments
• Lateral movements within AI systems: Attacks that move between different AI tools, APIs, and services, using outputs from one system as inputs to another
• Cross-conversation coordination: Attacks that span multiple separate conversations or sessions, building up context over time
• Tool and API chaining: Attacks that leverage multiple AI-powered tools in sequence, where each tool's output enables the next step

Traditional guardrails fail because they evaluate each prompt in isolation. They can't see how a seemingly benign request in one context becomes dangerous when combined with previous interactions or when its output feeds into another system.

Why This Visibility Matters for Your Business

Traditional security systems give you a simple "safe" or "unsafe" verdict—like a firewall that blocks traffic without explaining why. Intrinsec AI gives you something fundamentally different: complete visibility into how sensitive concepts within your AI system behave given your policy boundaries.

Here's what this means for your organization:

• See exactly what triggered alerts: Know what part of the prompt caused security concerns—not just that something was flagged
• Understand attack patterns: Watch how attackers structure their prompts, seeing how different parts work together to manipulate the system
• Map to your policies: See how content aligns with your specific security policies, not generic classifications
• Improve your defenses: Use insights from how attacks are structured to strengthen your security posture
• Build trust: Explain to stakeholders exactly why content was flagged, with full transparency
• Reduce false positives: Understand context better, reducing unnecessary blocks on legitimate content