How to meet it
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Normalise input before the model sees it
Verify that input normalization is applied before tokenization or embedding.
OWASP AISVS v1.01, requirement 2.1.1
In plain English
Convert input to one standard form before anything else looks at it. Otherwise text that looks different to your filters can look the same to the model, or the other way round.
What good looks like
- Unicode normalisation is applied to all text input before filtering and tokenisation.
- Invisible and control characters are removed or handled by a defined rule.
- The same normalisation runs for every route into the prompt.
How teams usually do it
- Unicode NFKC normalisation in the input layer, followed by your filters.
- A shared input-cleaning function used by chat, uploads and retrieval.
Evidence an auditor would accept
- The normalisation code and where it sits in the pipeline.
- Tests using look-alike characters and zero-width spaces.
Common mistakes
- Normalising after the filters have run, so the filters see the unnormalised text.
- Normalising the chat box but not text extracted from documents.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.