| name | continuous-monitoring |
| version | 2.0.0 |
| description | Real-time monitoring and detection of adversarial attacks and model drift in production |
| sasmp_version | 1.3.0 |
| bonded_agent | 05-defense-strategy-developer |
| bond_type | SECONDARY_BOND |
| input_schema | {"type":"object","required":["monitoring_type"],"properties":{"monitoring_type":{"type":"string","enum":["input_anomaly","output_quality","model_drift","security_events","all"]},"alert_threshold":{"type":"number","default":0.8}}} |
| output_schema | {"type":"object","properties":{"alerts":{"type":"array"},"metrics":{"type":"object"},"recommendations":{"type":"array"}}} |
| owasp_llm_2025 | ["LLM10","LLM02"] |
| nist_ai_rmf | ["Measure","Manage"] |
Continuous Monitoring
Implement real-time detection of adversarial attacks and model degradation in production AI systems.
Quick Reference
Skill: continuous-monitoring
Agent: 05-defense-strategy-developer
OWASP: LLM10 (Unbounded Consumption), LLM02 (Sensitive Disclosure)
NIST: Measure, Manage
Use Case: Detect attacks and drift in production
Monitoring Architecture
User Input → [Input Monitor] → [Model] → [Output Monitor] → Response
↓ ↓
[Anomaly Detection] [Quality Check]
↓ ↓
[Alert System] ←←←←←←←←←←←←←←←←←←←←←←
↓
[Incident Response]
Detection Categories
1. Input Anomaly Detection
Category: input_anomaly
Latency Impact: 10-20ms
Detection Rate: 85-95%
class InputAnomalyDetector:
def __init__(self, training_distribution):
self.mean = training_distribution.mean
self.cov = training_distribution.covariance
.threshold =
():
diff = input_embedding - .mean
distance = np.sqrt(diff.T @ np.linalg.inv(.cov) @ diff)
distance > .threshold:
AnomalyAlert(
=,
score=distance,
severity=._classify_severity(distance)
)
():
injection_patterns = [
,
,
,
]
pattern injection_patterns:
re.search(pattern, text_input, re.I):
AnomalyAlert(=, severity=)
