How to meet it
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Embedding Sanitization & Validation
Mask sensitive fields before embedding
Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.
OWASP AISVS v1.01, requirement 8.2.1
In plain English
Find sensitive fields before text is turned into embeddings, and mask, replace or drop them. Embeddings can be reversed to recover text.
What good looks like
- Personal and secret data is detected during ingestion.
- It is masked, tokenised or removed before embedding.
- The detection is tested.
How teams usually do it
- Personal data and secret detection tools in the ingestion pipeline.
Evidence an auditor would accept
- Pipeline configuration and detection test results.
Common mistakes
- Assuming embeddings are safe because they are just numbers.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.