How to meet it
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Respond to suspected extraction
Verify that detection of suspected extraction triggers response measures.
OWASP AISVS v1.01, requirement 11.3.4
In plain English
When extraction is suspected, respond automatically, for example by throttling, blocking or degrading responses for that caller.
What good looks like
- Responses to suspected extraction are defined.
- They trigger automatically.
- Someone reviews each case.
How teams usually do it
- Detector alerts wired to the API gateway to throttle or block.
Evidence an auditor would accept
- Response rules and logs.
Common mistakes
- Detection that only produces a weekly report.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.