Identifying High-Value Targets in AI Systems

Not all components of an AI system have equal value to an attacker. System prompts contain proprietary business logic and instructions that represent significant intellectual property. Model weights represent months of training compute and fine-tuning investment. Vector stores contain the organisation's internal knowledge base. API keys provide direct access to AI services that cost money per token. Identifying which of these targets exist and which are reachable from the current position determines where to focus exploitation effort.

System Prompts

The system prompt is the highest-value immediate target in most LLM deployments. It contains the instructions, persona, restrictions, and often sensitive context like internal URLs, credentials, and business rules that the operator does not want users to see. Confirm a system prompt exists and estimate its complexity:

A high token count at the start of a conversation with no prior messages indicates a large system prompt. This suggests the prompt contains substantial proprietary content worth extracting. The system prompt is the primary target for the system prompt extraction techniques in the exploitation phase.

Model Weights and Fine-Tunes

If the application uses a self-hosted or custom fine-tuned model rather than a hosted provider API, the model weights are a high-value target. Indicators of a self-hosted model:

A self-hosted model confirmed via an exposed Ollama or vLLM instance is directly downloadable if the model server has no authentication. Model weights extracted from a production fine-tune represent the organisation's training investment and may contain sensitive information absorbed during fine-tuning on proprietary data.

Vector Store Contents

The vector database contains the organisation's internal knowledge base — document chunks, support tickets, internal policies, and whatever else was ingested into the RAG pipeline. Assess what categories of data are stored:

Payload content from the first few records reveals the type and sensitivity of data in the vector store. Internal policy documents, customer data, financial records, or source code in the vector store represents a data exfiltration target independently of any AI attack — direct database access may be simpler than going through the model.

API Keys and Credentials

AI applications require API keys with real monetary value — every token costs money. A leaked OpenAI or Anthropic API key gives direct model access and can run up significant costs. Probe for credential exposure in application responses:

Training Data and Fine-Tuning Datasets

If the model was fine-tuned on proprietary data, that data may be extractable through membership inference or targeted prompting. Identify what data categories the model has been trained on:

A model that describes specialized knowledge in areas like internal company processes, proprietary products, or specific customer domains has been fine-tuned on that data. This data may be partially recoverable through extraction attacks in the embeddings and model internals exploitation phase.