How to meet it
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Safety
Block leaks of the system prompt
Verify that output filters detect and block responses that disclose system prompt content or backend data.
OWASP AISVS v1.01, requirement 7.3.2
In plain English
Assume people will try to get the model to repeat its instructions or reveal internal data, and check each response on the way out. Better still, make sure there is nothing in the instructions that would hurt if it leaked.
What good looks like
- The system prompt holds no secrets: no keys, internal URLs, access rules or other customers' data. A leak is then embarrassing and nothing more.
- Responses are checked against the system prompt text and against patterns for sensitive data such as keys and internal hostnames.
- Blocked responses are replaced with a neutral reply and logged.
- A unique canary phrase in the system prompt makes leaks easy to spot in logs and alerts.
How teams usually do it
- A similarity check between each response and the system prompt, so paraphrases are caught as well as exact copies.
- Secret-scanning patterns run on responses.
- Sensitive-information filters in your model platform's guardrails.
Evidence an auditor would accept
- Filter configuration, and tests showing common extraction prompts are blocked.
- A review confirming the system prompt contains no secrets.
- Sample alerts for blocked responses.
Common mistakes
- Putting API keys or access rules in the prompt.
- Relying on "never reveal these instructions" inside the prompt itself.
- Matching exact text only. Translation, paraphrase or encoding such as Base64 gets straight past it.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.