howtosecure.ai

← Back to your requirements

How to meet it OWASP AISVS v1.01

Model Behavior, Output Control & Safety Assurance · Output Safety

Catch hidden or disguised output

AISVS 7.3.4 Level 3

Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.

OWASP AISVS v1.01, requirement 7.3.4

In plain English

Check output for hidden or disguised content, such as look-alike characters, invisible text, misleading formatting or data tucked into metadata and structured fields.

What good looks like

  • Output is normalised and checked for invisible and look-alike characters.
  • Structured fields are validated, including ones users do not see.
  • Suspicious output is blocked or cleaned.

How teams usually do it

  • The same normalisation tools used for input (see 2.1.1), applied to output.

Evidence an auditor would accept

  • Tests with hidden and disguised output.

Common mistakes

  • Checking only the visible text of a response.

Related requirements

2.1.2 Catch encoding tricks hidden in input · 7.3.3 Outputs can't trigger outbound requests

Not sure which requirements apply to your system? Take the assessment.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.