How to meet it
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Stop special tokens being injected
Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.
OWASP AISVS v1.01, requirement 2.1.7
In plain English
Make sure users cannot type the model's special control tokens, such as the markers that start a system message, and have them treated as real instructions.
What good looks like
- Text from users and documents is tokenised so reserved tokens become plain text.
- Inputs containing reserved token strings are tested and handled.
- The check is repeated when you change model or tokeniser.
How teams usually do it
- Using the provider's chat API with roles, so you never build raw prompt strings.
- For self-hosted models, tokenising untrusted text with special tokens disabled.
Evidence an auditor would accept
- Code showing how prompts are built.
- Test cases that include the model's reserved token strings.
Common mistakes
- Building a raw prompt string by joining text for a self-hosted model.
- Testing with one model's tokens and then switching to a model with different ones.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.