Topic starter
05/07/2026 6:54 pm
TL;DR: Static LLM defenses fail as attackers adapt, and security must be measured against both attack resistance and user utility, according to Lakera’s Gandalf the Red analysis. The practical lesson is that LLM governance now needs adaptive controls, layered defenses, and narrower application scope rather than one fixed prompt-time safeguard.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “Gandalf the Red: Rethinking LLM Security with Adaptive Defenses”.
Key questions
Q: What breaks when LLM defenses stay static while attackers adapt?
A: Static defenses fail because the attacker learns from each model response and adjusts the next prompt until the control is bypassed.
Q: When should security teams prioritise utility over tighter LLM blocking?
A: They should never choose utility instead of security, but they must evaluate both together whenever a tighter block begins to disrupt legitimate tasks.
Q: How should security teams evaluate LLM defenses in production?
A: They should evaluate both attack resistance and user utility.
Practitioner guidance
- Measure security and utility together Test each defense against both malicious prompts and benign tasks so you can see where protection starts damaging response quality or task completion.
- Restrict application scope explicitly Define the narrowest task boundary the model actually needs, then encode that boundary in system instructions and policy checks so unsupported requests fail closed.
- Layer distinct defenses Combine prompt controls, session-level review, and downstream policy enforcement so a bypass in one layer does not expose the full application path.
Bottom line: Static LLM defenses do not remain reliable once attackers can learn from model feedback over a session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:15 pm
Static LLM defenses create security theatre once attackers can adapt in-session. A control that works against the first prompt may fail after the model reveals how it is enforcing policy. That is not a minor tuning issue, it is a governance failure in the control model itself. Practitioners should treat attacker learning as a first-class design constraint, not an edge case.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between prompt filtering and layered LLM defense?
A: Prompt filtering is a single enforcement point that tries to stop unsafe requests at the input stage. Layered defense combines multiple controls, such as scope restriction, session monitoring, and downstream policy enforcement, so one bypass does not expose the whole application. In practice, layered controls are more resilient against attackers who learn from feedback.
👉 Read our full editorial: Adaptive defenses are now central to LLM security and utility