How to meet it
OWASP AISVS v1.01
Training Data Integrity & Traceability · Training Data Quality and Security Assurance
Check security-relevant models for bias
Verify that models used in security-relevant decisions are evaluated for bias patterns.
OWASP AISVS v1.01, requirement 1.3.3
In plain English
If the model helps make security decisions, test whether it treats some groups, sources or inputs unfairly, since that can create blind spots an attacker can use.
What good looks like
- Models used in security decisions are tested on performance across relevant groups or input types.
- Large gaps are investigated and either fixed or documented with a reason.
- Tests are repeated when the model or data changes.
How teams usually do it
- Slice-based evaluation, comparing error rates across groups or input categories.
- Fairness toolkits for the metrics, with thresholds agreed with the people who use the decisions.
Evidence an auditor would accept
- Evaluation reports broken down by group or category.
- Records of how large gaps were handled.
Common mistakes
- Reporting one overall accuracy figure that hides poor performance on a subgroup.
- Testing once at launch and never again.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.