When a dynamic scan completes, the scan report contains a dynamicScan object with a summary of the run and the list of findings. This section explains its structure with a shortened real example. Host names, canary token values and conversation IDs are masked. The personal data in some findings (a Social Security number and a phone number) is synthetic test data planted by Aether, not real information.
Findings quote the target model's raw responses as evidence. These can contain unsafe, offensive or otherwise sensitive text produced in response to the adversarial probes. Handle scan reports with care.
In the Aether report
The report overview shows the final verdict and the top threat indicators. The Dynamic LLM Probes tab lists each finding, with the prompt that Aether sent and the response of the model.
In the JSON report
Top-level structure
Field | Meaning |
|---|---|
| The LLM Inference Server that the scan targeted (the configured Harness Address). |
| The model ID used in requests. Derived from the scanned file's name (see 3.3). |
| The total elapsed time of the dynamic scan. |
| The effective configuration of the run:
|
| The total tokens sent to and received from the target model during the whole scan. |
| A probe is one attack scenario (a family of related prompts). Selected means the probe matched the selection filters. Run means it was actually executed. Truncated means it was skipped because a budget ran out first. |
| Counts for individual requests. |
|
|
| The number of findings, and the findings themselves (see Findings). |
| Operational errors of the scan itself (empty on a clean run). Failures of individual prompts are counted in |
Budgets
The settings.budgets object holds the limits of a scan:
wallClockS: the maximum total scan time, in seconds. When it runs out, the remaining probes are truncated andtruncatedis set.maxRequests: the maximum number of requests sent to the target in one scan.maxPerProbe: the maximum number of prompts sent for a single probe.stopAfterUnsafe: stop the scan early after this many unsafe outcomes (0= never stop early).maxConsecutiveFailures: stop the scan if this many prompts fail in a row. This protects against an endpoint that is down.
Findings
Each entry in findings is one failed probe outcome: a prompt whose response was judged unsafe. Example (shortened and masked):
Field | Meaning |
|---|---|
| A stable rule identifier in the form |
| The impact rating: |
| The threat category that the probe tests, aligned with common LLM risk taxonomies, for example Prompt Injection, System Prompt Leakage, Sensitive Information Disclosure or Improper Output Handling. |
| The internal probe family that the prompt belongs to (for example, |
| Where the finding comes from, in the form |
| The exact attack prompt that was sent and the model's raw reply. Together they are the evidence of the behavior. The response is quoted word for word. |
| A suggested mitigation for the observed behavior (for example, output moderation, canary scrubbing or HTML-encoding of model output). |
| One entry for each judge that scored the response: the judge name (for example, |
| The public corpora and tools that the probe technique maps to (for example, |
| The identifier of the specific prompt in the rule that triggered the finding. |
| The response time of the target model for this prompt. |
| The identifier of the conversation in which the prompt was sent, so that multi-turn exchanges can be traced. |
Canary tokens
Some findings refer to LMS-CANARY-* values. These are unique synthetic secrets that Aether plants in the target's system prompt or context at the start of the scan. They have no meaning outside the scan. If one appears in a model response, that is direct proof that the model leaked protected context (system prompt leakage or sensitive data disclosure). This is why canary matches score 1.0. The same applies to the planted fake personal data, such as the Social Security number 123-45-6789: the scanner plants it so that it can detect when the data appears in the output.
How to read a report
Start with
findingsCountand the spread of severities. Critical and high findings show that the model complied with attacks (jailbreaks, data leakage or unsafe output) and needs guardrails before deployment.Use
promptandresponseto see exactly what the model did, andremediationfor the suggested countermeasure.Check
truncated. If it istrue, the findings list is a minimum, because not all selected probes ran within the budget.Repeated
ruleIdvalues (such as the threeLMS-DYN-EXFIL-001findings in the full example) show the same weakness reproduced with different wording, which makes the evidence stronger.