How to meet it
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Isolate on-device inference
Verify that inference runtimes enforce process, memory, and file access isolation.
OWASP AISVS v1.01, requirement 4.3.3
In plain English
On devices, run inference in an isolated process with restricted access to memory and files.
What good looks like
- The inference runtime runs in its own process or sandbox.
- It can read only the files it needs.
- Other apps cannot read its memory.
How teams usually do it
- Platform sandboxing features on mobile and embedded operating systems.
Evidence an auditor would accept
- Runtime configuration and platform permission settings.
Common mistakes
- Running inference inside the main app process with full app permissions.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.