How to meet it
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Detect many-shot jailbreaks
Verify that the system can detect many-shot jailbreaking patterns.
OWASP AISVS v1.01, requirement 2.1.8
In plain English
Detect many-shot jailbreaks, where an attacker fills the context with dozens of fake question-and-answer examples that teach the model to misbehave.
What good looks like
- Inputs with large numbers of dialogue-style examples are detected.
- Detection covers retrieved and uploaded content as well as typed messages.
- Detected attempts are blocked and logged.
How teams usually do it
- Pattern checks for repeated question and answer structures in a single input.
- Limits on input length (see 2.1.4) combined with a classifier trained on many-shot examples.
Evidence an auditor would accept
- Detection rules or classifier settings.
- Test results with sample many-shot attacks.
Common mistakes
- Relying on a length limit alone, when the context window still allows dozens of examples.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.