> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/additional-security-engines/genai-security/genai-security-learning.md).
# GenAI Security Learning
When GenAI Security is activated for an asset, the underlying engine starts to learn your application's domain - the types of prompts that are normal for your application.
The learning represents how well the model understands your domain. The better the model understands the domain of your application, the more accurate its protection becomes.
You can track the learning progress in the Learn tab of the asset. Note that learning data appears only after the asset receives its first prompts — until then, the Learn tab has no data to show. After the first prompts are inspected, the tab shows:
* Statistics (last 7 days) — the number of Benign and Malicious prompts inspected
* Elapsed Time — the time since the last change in the learning level or status
* Learning Level — how well the model understands your application's domain
* Status — how the model is behaving right now
The Learning Level and the Status each include a tooltip. Hover over them to see an explanation of the current state and what is needed for the model to advance.
#### Understand the Learning Level
When prompts are inspected, the GenAI Security learning engine reaches different learning levels. Each level represents how well the model understands your application's domain. The learning levels are based on a set of internal quality criteria that the model must meet — as the model passes more of these criteria, the learning level rises. At every level below PhD, the way to improve is the same: more prompts that cover more of your application's domain. The model progresses through the following learning levels:
| Learning Level | What It Means |
| -------------- | ---------------------------------------------------------------------------------------------------------------- |
| Kindergarten | The model has just started learning your application |
| Primary School | The model has built an initial understanding of your application's domain |
| High School | The model covers more aspects of your application, and its understanding keeps growing |
| Graduate | The model understands your domain well and meets part of the quality criteria |
| Master | The model understands your domain very well and meets most of the quality criteria |
| PhD | The highest level. The model meets all the quality criteria and operates within a high-quality performance range |
Note: It is not possible to estimate in advance when the learning level will change. Progress depends on the number of prompts inspected and on their quality — how well they cover the full domain of your application. An application that receives varied prompts across all its use cases progresses faster than one that receives many repetitive prompts covering only a small part of its domain.
The learning level can also decrease. This happens when the model detects a change in the application's traffic and returns to a learning stage to adapt, or when some of the quality criteria are temporarily not met (see Understand the Status below). This is normal and expected, and the level rises again as more prompts are collected.
#### Understand the Status
The Status represents the current state of the model:
| Status | What It Means |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Getting Started | The model is beginning to learn your application. More prompts are needed before the model can advance to the next stage |
| Prompts Required | An initial model was created, but it is still learning your application's domain. More variants of prompts, covering more of your application's use cases, are needed before the model can advance |
| Learning | The normal state for most of the asset's life cycle. The model actively learns from the prompts it inspects and keeps improving its understanding of your domain. No action is required |
| Relearning | The model detected a change in your application's traffic — for example, new use cases, new types of prompts, or new attack patterns - and returned to a learning stage to adapt. The learning level may temporarily decrease. No action is required; the model advances again as more prompts are collected. See When does the model return to learning? below |
#### When does the model return to learning?
Even after the model has learned your application's domain, it continues to look at the traffic. The model returns to a learning state (Relearning) in these cases:
1. New areas of your domain appear. The application starts to receive prompts from a subdomain or use case the model has not seen before, and the model learns it.
2. New attack patterns appear. The model sees new attacks against your application and learns to recognize them.
Relearning is normal and expected. It reflects the changing life cycle of a GenAI application- new features, new topics, and new threats appear over time, and the model adapts to them. During Relearning, the learning level may temporarily decrease and then rise again.
Note: In Relearning, allow at least 24 hours before expecting the learning level or status to change again. This gives the model time to stabilize on the new data.
#### Track the Learning
1. Go to Policy > Assets and select the GenAI asset you want to track.
2. Select the Learn tab. This tab shows the Statistics of the last 7 days, the Elapsed Time, the Learning Level, and the Status.
3. Hover over the Learning Level and Status tooltips to see the current state and what is needed for the model to advance.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://waf-doc.inext.checkpoint.com/additional-security-engines/genai-security/genai-security-learning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.