Runtime Application Self-Protection (RASP)

RASP integrates directly into the model serving process via agents or SDKs, gaining visibility into API calls, data flows, and code-level execution. Unlike a WAF, it sees deserialized payloads and understands application logic, allowing it to detect attacks like adversarial perturbations after TLS decryption but before they reach the inference engine.

RASP analyzes the internal state of the application to distinguish legitimate requests from attacks. Key capabilities include:

• Execution Flow Monitoring: Detects when an input forces the model down an anomalous code path.
• Data Flow Tracking: Follows tainted input through the serving pipeline to prevent injection.
• Semantic Validation: Understands that a tensor of pixel values should not contain SQL metacharacters, blocking blind injection attacks that signature-based tools miss.

Because RASP operates inside the runtime, it generates high-fidelity security telemetry unique to ML systems. It can log the exact input tensor that triggered a block, the model version targeted, and the specific layer where an anomaly occurred. This data feeds directly into SIEM and UEBA systems, providing security operations centers with the context needed to trace advanced model extraction or membership inference attempts.

RASP agents are deployed as sidecars in Kubernetes pods or as language-level libraries, aligning with modern MLOps pipelines. Configuration is managed as code, enabling:

• Auto-instrumentation: Agents attach automatically to new model replicas during scaling events.
• Policy as Code: Blocking rules for prompt injection or adversarial inputs are version-controlled alongside model weights.
• Zero-Day Virtual Patching: Security teams can deploy detection logic for newly discovered vulnerabilities without redeploying the model, reducing the window of exposure.

RASP neutralizes threats at the point of exploitation, eliminating the need for round-trip analysis to an external cloud service. This is critical for:

• Air-gapped deployments: Sovereign AI systems that cannot leak data to external security scanners.
• Latency-sensitive inference: Real-time applications where network calls to a detection API would violate service level agreements.
• Confidential computing: RASP runs inside the same Trusted Execution Environment (TEE) as the model, maintaining the hardware-enforced security boundary.

RASP offers graduated enforcement options to balance security with availability:

• Monitor-Only Mode: Logs all detected attacks without interrupting inference, used during initial tuning to establish baselines and eliminate false positives.
• Block Mode: Terminates malicious requests and returns a generic error to the caller, preventing information leakage about the defense mechanism.
• Honeytoken Mode: Redirects suspected attackers to a shadow model that returns plausible but fabricated outputs, wasting the adversary's resources while gathering threat intelligence.

The process of cleaning and validating all data supplied to a model inference endpoint before processing. This is a critical pre-processing step that RASP instrumentation can enforce at the application layer.

• Neutralizes malicious content such as code injection attempts
• Strips adversarial perturbations designed to cause misclassification
• Validates data types, ranges, and structural integrity
• Acts as a first-pass filter that reduces the attack surface RASP must monitor

The enforcement of a strict data contract on all inference requests, typically defined by an OpenAPI Specification. Schema validation rejects malformed inputs before they reach model execution logic.

• Rejects requests with unexpected data types or missing required fields
• Prevents buffer overflow and injection attacks via structural constraints
• Defines allowed ranges for numerical inputs to block out-of-band attacks
• RASP can leverage schema context to identify semantically invalid but syntactically correct attacks

A component in a zero-trust architecture that intercepts requests to a protected resource and enforces access decisions. RASP functions as an application-level PEP embedded directly in the serving runtime.

• Intercepts every inference request at the point of execution
• Queries external policy engines like Open Policy Agent for authorization decisions
• Enforces decisions without relying on network perimeter controls
• Provides defense-in-depth when combined with gateway-level PEPs

A training methodology that improves model resilience against perturbed or manipulated inputs. While RASP detects attacks at runtime, adversarial training hardens the model itself during development.

• Incorporates adversarial examples into the training dataset
• Uses techniques like Projected Gradient Descent (PGD) to generate robust weights
• Reduces the model's susceptibility to evasion attacks
• Complements RASP by making the underlying model inherently harder to exploit

A defensive mechanism that analyzes sequential query patterns to identify black-box extraction attacks. RASP instrumentation provides the telemetry needed for this detection by monitoring internal execution context.

• Detects systematic probing indicative of model extraction attempts
• Tracks query distribution, confidence score harvesting, and decision boundary mapping
• Triggers rate limiting or response degradation when extraction is suspected
• Leverages RASP's internal state visibility to distinguish legitimate from malicious query patterns