This article describes a hands-on cybersecurity lab that teaches defenders how to detect multi-stage prompt injection attacks against AI systems. The core problem is that prompt firewalls typically evaluate each user message in isolation and miss coordinated attacks spread across multiple conversation turns, where each individual message appears harmless. The lab trains practitioners to implement session-level detection that scores the trajectory of an entire conversation rather than individual messages.
- Single-message firewalls have a structural blind spotPrompt firewalls that score each incoming message independently cannot detect multi-stage attacks, where hostility emerges from the sequence and escalation pattern across turns rather than from any single message. The article demonstrates that attackers engineer these sequences so each message passes per-message classifiers individually, hiding the hostile goal in the trajectory between turns.
- Multi-turn attacks use staged setup and escalationThe lab's five attack sequences each spread a hostile goal across turns through benign setup followed by gradual escalation and then exploitation. In contrast, the three legitimate sessions show consistent, task-focused behavior with no escalation toward the system's internals or guardrails, making escalation patterns a key differentiator.
- Session-level aggregation sees what per-message scoring missesEffective detection must aggregate risk signals across the entire session, modeling the trajectory of escalation, staged setup patterns, and callbacks to earlier turns. This session-aggregate scoring captures the behavioral pattern that multi-turn attacks rely on—something a single-message classifier by definition cannot observe.
- Balancing detection with user trust requires low false positivesThe lab requires flagging at least four of five attack sequences while flagging zero of three legitimate sessions. The article emphasizes that keeping false positives low is essential because unnecessary blocking of legitimate users erodes trust in the security control itself.
- Combining multiple detection layers strengthens defensesThe article recommends combining detection layers across input analysis, output analysis, and behavioral analysis rather than relying on a single classifier. This layered approach supports the OWASP LLM Top 10 and provides defense-in-depth against multi-stage attacks.
- Evaluation must test against multi-turn sequencesThe article warns that any prompt firewall should be evaluated using multi-turn attack sequences rather than isolated single-message payloads. If a firewall only scores individual messages, staged attacks will pass through it undetected.
Bottom line: Defenders must shift from scoring isolated messages to aggregating risk across entire conversation sessions, modeling how attacks escalate and build across turns. Implementing session-level behavioral detection is the current best practice and is essential to catch the multi-stage attacks that single-message classifiers are designed to miss.
📋 In this walkthrough
What this lab teaches
Prompt firewalls that score messages one at a time miss multi-stage attacks, where each step is individually benign but the sequence is hostile. Effective detection aggregates across the session, scoring the trajectory rather than isolated messages. This lab is about building that session-level detection.
The lesson: multi-turn attacks hide in the gaps between messages. Detection has to look at the whole conversation.
How ShieldBot scores prompts
You have an attack log: five multi-stage attack sequences and three legitimate sessions. The existing rules catch single messages. Your task is detection that flags at least four of the five sequences while flagging none of the three legitimate sessions.
The attack approach
- Review the log and see why single-message scoring misses the multi-stage attacks.
- Identify cross-turn patterns — escalation, staged setup, probing then exploitation.
- Add session-aggregate rules that score the sequence, not just each message.
- Tune to flag at least four of five sequences with zero false positives.
Full walkthrough (spoiler)
If single-message rules keep missing them, move scoring up to the session — open the steps.
Show the step-by-step solution
- Characterise the five attack sequences: each spreads a hostile goal across turns (benign setup, gradual escalation, then exploitation) so no single message scores high.
- Characterise the three legitimate sessions: consistent, task-focused, with no escalation toward the system's internals or guardrails.
- Add rules that aggregate signals across the session — rising sensitivity, staged setup, references back to earlier turns — rather than scoring messages in isolation.
- Tune thresholds so at least four sequences are flagged and none of the legitimate sessions are. The lab marks you solved.
Why it works
Multi-stage attacks are engineered so each message passes a per-message classifier. The hostility is in the trajectory — the way turns build on each other. Session-aggregate scoring sees that trajectory, which is exactly what a single-message firewall cannot.
Where this happens in the real world
Single-message classifiers missing multi-turn attacks is a known weakness of naive prompt firewalls; session-aggregate scoring is the current best practice. Detection-first defence is harder than attacking and more valuable, and it supports the whole OWASP LLM Top 10.
How to defend against it
- Aggregate risk across the session, not per message.
- Model the trajectory — escalation, staged setup, callbacks to earlier turns.
- Combine detection layers (input, output, behaviour) rather than one classifier.
- Keep false positives low so legitimate users are not blocked, which erodes trust in the control.
Try it, then go further
Reading about it is the easy part. Open the lab, try your own approach before peeking at the spoiler, and see how many attempts it takes.
