How to meet it
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Model, Data, and Performance Drift Detection
Tell unexplained shifts from normal drift
Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.
OWASP AISVS v1.01, requirement 12.3.4
In plain English
Tell the difference between gradual, expected drift and sudden or unexplained changes in behaviour, which may mean tampering or a silent model change.
What good looks like
- Expected drift is modelled or bounded.
- Sudden shifts trigger investigation.
- Known causes, such as releases, are recorded so they can be ruled out.
How teams usually do it
- Change-point detection on behaviour metrics, with release annotations.
Evidence an auditor would accept
- Detection rules and an investigated example.
Common mistakes
- One threshold for all change, so sudden shifts look like ordinary drift.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.