How to meet it
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Workload Sandboxing & Validation
Protect weights during inference
Verify that confidential inference services protect model weights during runtime through isolated execution environments.
OWASP AISVS v1.01, requirement 4.1.4
In plain English
Protect model weights while they are in use, so even the host operator cannot read them during inference.
What good looks like
- Inference runs in an isolated execution environment that encrypts memory.
- Weights are decrypted only inside that environment.
- Attestation is required before weights are released.
How teams usually do it
- Confidential VMs or confidential GPU offerings from cloud providers.
Evidence an auditor would accept
- Architecture showing where weights are decrypted.
- Attestation configuration.
Common mistakes
- Encrypting weights at rest but loading them into ordinary memory on shared hosts.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.