GenAI Security Learning

When GenAI Security is activated for an asset, the underlying engine starts to learn your application's domain - the types of prompts that are normal for your application.

The learning represents how well the model understands your domain. The better the model understands the domain of your application, the more accurate its protection becomes.

You can track the learning progress in the Learn tab of the asset. Note that learning data appears only after the asset receives its first prompts — until then, the Learn tab has no data to show. After the first prompts are inspected, the tab shows:

• Statistics (last 7 days) — the number of Benign and Malicious prompts inspected

• Elapsed Time — the time since the last change in the learning level or status

• Learning Level — how well the model understands your application's domain

• Status — how the model is behaving right now

The Learning Level and the Status each include a tooltip. Hover over them to see an explanation of the current state and what is needed for the model to advance.

Understand the Learning Level

When prompts are inspected, the GenAI Security learning engine reaches different learning levels. Each level represents how well the model understands your application's domain. The learning levels are based on a set of internal quality criteria that the model must meet — as the model passes more of these criteria, the learning level rises. At every level below PhD, the way to improve is the same: more prompts that cover more of your application's domain. The model progresses through the following learning levels:

Learning Level	What It Means
Kindergarten	The model has just started learning your application
Primary School	The model has built an initial understanding of your application's domain
High School	The model covers more aspects of your application, and its understanding keeps growing
Graduate	The model understands your domain well and meets part of the quality criteria
Master	The model understands your domain very well and meets most of the quality criteria
PhD	The highest level. The model meets all the quality criteria and operates within a high-quality performance range

Note: It is not possible to estimate in advance when the learning level will change. Progress depends on the number of prompts inspected and on their quality — how well they cover the full domain of your application. An application that receives varied prompts across all its use cases progresses faster than one that receives many repetitive prompts covering only a small part of its domain.

The learning level can also decrease. This happens when the model detects a change in the application's traffic and returns to a learning stage to adapt, or when some of the quality criteria are temporarily not met (see Understand the Status below). This is normal and expected, and the level rises again as more prompts are collected.

Understand the Status

The Status represents the current state of the model:

Status	What It Means
Getting Started	The model is beginning to learn your application. More prompts are needed before the model can advance to the next stage
Prompts Required	An initial model was created, but it is still learning your application's domain. More variants of prompts, covering more of your application's use cases, are needed before the model can advance
Learning	The normal state for most of the asset's life cycle. The model actively learns from the prompts it inspects and keeps improving its understanding of your domain. No action is required
Relearning	The model detected a change in your application's traffic — for example, new use cases, new types of prompts, or new attack patterns - and returned to a learning stage to adapt. The learning level may temporarily decrease. No action is required; the model advances again as more prompts are collected. See When does the model return to learning? below

When does the model return to learning?

Even after the model has learned your application's domain, it continues to look at the traffic. The model returns to a learning state (Relearning) in these cases:

1. New areas of your domain appear. The application starts to receive prompts from a subdomain or use case the model has not seen before, and the model learns it.

2. New attack patterns appear. The model sees new attacks against your application and learns to recognize them.

Relearning is normal and expected. It reflects the changing life cycle of a GenAI application- new features, new topics, and new threats appear over time, and the model adapts to them. During Relearning, the learning level may temporarily decrease and then rise again.

Note: In Relearning, allow at least 24 hours before expecting the learning level or status to change again. This gives the model time to stabilize on the new data.

Track the Learning

1. Go to Policy > Assets and select the GenAI asset you want to track.

2. Select the Learn tab. This tab shows the Statistics of the last 7 days, the Elapsed Time, the Learning Level, and the Status.

3. Hover over the Learning Level and Status tooltips to see the current state and what is needed for the model to advance.