AISVS Research Wiki

OWASP AI Security Verification Standard: Research and Analysis Hub

Welcome to the AISVS research wiki. This wiki provides structured research context for every chapter and appendix in AISVS 1.01, helping developers, auditors, and security teams understand and implement each requirement. Every requirement is mapped to the threats it mitigates, the tools and techniques available to implement it, practical verification approaches, and open questions where tooling or research is still maturing. Whether you are building an AI application, auditing one, or evaluating your organization's AI security posture, this wiki is designed to help you get started.

---

Chapters

The standard is organized into 12 chapters spanning the full AI application security lifecycle, from training data through deployment, monitoring, and human oversight. Every chapter has per-section sub-pages for focused navigation, plus a hub page with cross-cutting threat landscape, tooling, and research context.

#	Chapter	Reqs	Pages	Type	Updated
C1	Training Data Integrity & Traceability	13	C01	3 sections	2026-07-14
C2	Input Validation	12	C02	2 sections	2026-09-07
C3	Model Lifecycle Management & Change Control	15	C03	5 sections	2026-07-14
C4	Infrastructure, Configuration & Deployment Security	14	C04	3 sections	2026-07-14
C5	Access Control & Identity for AI Components & Users	11	C05	3 sections	2026-07-14
C6	Supply Chain Security for Models	7	C06	2 sections	2026-07-13
C7	Model Behavior, Output Control & Safety Assurance	14	C07	4 sections	2026-09-07
C8	Memory, Embeddings & Vector Database Security	11	C08	3 sections	2026-07-14
C9	Orchestration & Agentic Security	36	C09	6 sections	2026-09-07
C10	Model Context Protocol (MCP) Security	25	C10	4 sections	2026-09-07
C11	Adversarial Robustness	18	C11	4 sections	2026-09-07
C12	Monitoring, Logging & Anomaly Detection	21	C12	5 sections	2026-07-14
	Total	197	59 pages

---

C1: Training Data Integrity & Traceability

Covers training data origin and traceability, data security and integrity, labeling and annotation security, quality assurance, and data lineage.

Section	Page
C1.1 Training Data Origin & Data Security	C01-01
C1.2 Data Labeling and Annotation Security	C01-02
C1.3 Training Data Quality and Security Assurance	C01-03

C2: Input Validation

Covers prompt injection defense, pre-tokenization normalization, content and policy screening, and multi-modal input validation.

Section	Page
C2.1 Prompt Injection Defenses	C02-01
C2.2 Content & Policy Screening	C02-02

C3: Model Lifecycle Management & Change Control

Covers model authorization and integrity, validation and testing, controlled deployment and rollback, secure development practices, hosted/provider-managed controls, and fine-tuning pipeline integrity.

Section	Page
C3.1 Model Authorization & Integrity	C03-01
C3.2 Model Validation & Testing	C03-02
C3.3 Controlled Deployment & Rollback	C03-03
C3.4 Secure Development Practices	C03-04
C3.5 Pipeline Fine-Tuning	C03-05

C4: Infrastructure, Configuration & Deployment Security

Covers AI-specific workload sandboxing and confidential computing, AI accelerator hardware security, and edge or distributed AI deployment security.

Section	Page
C4.1 AI Workload Sandboxing & Validation	C04-01
C4.2 AI Hardware Security	C04-02
C4.3 Edge & Distributed AI Security	C04-03

C5: Access Control & Identity for AI Components & Users

Covers AI-specific authentication, resource authorization and classification, query-time authorization, output entitlement enforcement, policy decision point isolation, and multi-tenant isolation.

Section	Page
C5.1 Authentication	C05-01
C5.2 AI Resource Authorization & Classification	C05-02
C5.3 Multi-Tenant Isolation	C05-03

C6: Supply Chain Security for Models

Covers model artifact scanning, approved-source enforcement, integrity verification, behavioral acceptance testing, and signed AI bills of materials.

Section	Page
C6.1 Model Artifact Integrity	C06-01
C6.2 AI BOM & Supply Chain Monitoring	C06-02

C7: Model Behavior, Output Control & Safety Assurance

Covers output format enforcement, hallucination detection, output safety and privacy filtering, generative media safeguards, and source attribution.

Section	Page
C7.1 Output Format Enforcement	C07-01
C7.2 Hallucination Detection & Mitigation	C07-02
C7.3 Output Safety	C07-03
C7.4 Source Attribution & Citation Integrity	C07-04

C8: Memory, Embeddings & Vector Database Security

Covers vector identifier and namespace isolation, retrieval scope enforcement, embedding sanitization and quarantine, source validation for agent/tool memory writes, contradiction checks, expiry, reset, and quarantine exclusion.

Section	Page
C8.1 Access Controls on Memory & RAG Indices	C08-01
C8.2 Embedding Sanitization & Validation	C08-02
C8.3 Memory Expiry & Revocation	C08-03

C9: Orchestration & Agentic Security

Covers execution budgets, approval gates for high-impact actions, component isolation, agent and orchestrator identity, authorization and delegation, and shutdown or graceful degradation for autonomous and multi-agent systems.

Section	Page
C9.1 Execution Budgets, Loop Control, and Circuit Breakers	C09-01
C9.2 High-Impact Action Approval and Irreversibility Controls	C09-02
C9.3 Component Isolation and Tool Authorization	C09-03
C9.4 Agent and Orchestrator Identity	C09-04
C9.5 Agent Authorization, Delegation, and Continuous Enforcement	C09-05
C9.6 Shutdown and Graceful Degradation	C09-06

C10: Model Context Protocol (MCP) Security

Covers MCP component integrity, authentication and authorization, transport security, and schema and message validation.

Section	Page
C10.1 Component Integrity	C10-01
C10.2 Authentication & Authorization	C10-02
C10.3 Secure Transport	C10-03
C10.4 Schema, Message, and Input Validation	C10-04

C11: Adversarial Robustness

Covers model alignment and safety testing, adversarial hardening, membership inference and model inversion resistance, model extraction defense, and model runtime anomaly detection.

Section	Page
C11.1 Model Alignment, Safety, and Robustness Testing and Training	C11-01
C11.2 Membership-Inference and Model-Inversion Mitigation	C11-02
C11.3 Model-Extraction Defense	C11-03
C11.4 Model Runtime Anomaly Detection	C11-04

C12: Monitoring, Logging & Anomaly Detection

Covers request and response logging, abuse detection, model and data drift detection, performance telemetry, AI incident response, proactive security behavior monitoring, and training-data and model-lifecycle audit.

Section	Page
C12.1 Request & Response Logging	C12-01
C12.2 Detection and Alerting	C12-02
C12.3 Model, Data, and Performance Drift Detection	C12-03
C12.4 Proactive Security Behavior Monitoring	C12-04
C12.5 Training Data & Model Lifecycle Audit	C12-05

Appendices

The appendices provide supporting material including a glossary of AI security terms, an inventory of security controls mapped to the standard, and requirements for AI-assisted secure coding.

Appendix	Page	Updated
A: Glossary	Appendix A Glossary	2026-07-12
B: AI Security Controls Inventory	Appendix B Controls Inventory	2026-07-12
C: AI-Assisted Secure Coding (68 reqs)	Appendix C AI Secure Coding	2026-07-13

---

Page Structure

Every wiki page follows a consistent format to make research easy to navigate. Each requirement has a research table with the following columns:

Column	Purpose
Requirement	Full text from the AISVS standard
Level	Verification level (1, 2, or 3)
Threat Mitigated	Specific attack technique, failure mode, or risk
Verification Approach	Concrete audit steps, tools, and checks
Gaps / Notes	Tooling maturity, open issues, implementation caveats

Beyond the requirement tables, pages include threat landscape summaries, notable real-world incidents, tooling recommendations with implementation maturity ratings, open research questions, references to related standards, and cross-chapter links to related requirements.

---

Contributing

This wiki is maintained alongside the AISVS repository. If you spot inaccuracies, know of relevant tooling or research, or want to improve the coverage of any section, contributions are welcome. Open an issue or submit a pull request to get involved.