Implementation guide
OWASP AISVS v1.01
Training Data Integrity & Traceability · Data Labeling and Annotation Security
Protect labels from tampering
Verify that cryptographic integrity is applied to labeling artifacts.
OWASP AISVS v1.01, requirement 1.2.2
In plain English
Protect finished label files so nobody can alter them between labelling and training without it showing. In practice that means hashing or signing each approved export and checking it before use.
What good looks like
- Each approved label export is hashed (SHA-256 or stronger) or digitally signed at the moment of approval.
- The training pipeline checks the hash or signature and stops if it fails.
- A change to approved labels creates a new version. The old version is kept.
- The signing key belongs to the pipeline and is not available to individual labellers.
How teams usually do it
- Record the hash of each label export in the same manifest as the dataset it belongs to.
- Sign exports with a pipeline-held key, for example using Sigstore cosign or a cloud key management service, and verify at training time.
- Keep label sets in versioned storage so every change leaves a trace.
Suggested evidence
- Signed or hashed label exports and the manifest that lists them.
- Pipeline logs showing verification ran before training.
- The version history of a label set that was corrected after approval.
Common mistakes
- Protecting the raw data carefully and treating labels as editable spreadsheets.
- Fixing labels by hand in the approved file, with no new version.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.