Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model Alignment, Safety, and Robustness Testing and Training
Harden the model against adversarial input
Verify that models are hardened against adversarial inputs.
OWASP AISVS v1.01, requirement 11.1.4
In plain English
Make the model harder to fool. Testing (11.1.3) shows where it breaks, and hardening is what you do about it. No model is immune, so the aim is a measured reduction in how often attacks succeed.
What good looks like
- At least one hardening measure is in place for each input type.
- Its effect is measured using the tests from 11.1.3, before and after.
- Hardening is repeated or re-verified when the model changes.
- The remaining risk is written down and covered by other controls.
How teams usually do it
- Where you train the model: adversarial training, which adds attack examples to the training data.
- Where you use a provider's model: guard models and classifiers in front of and behind it, input transformations such as paraphrasing or re-encoding, and a tightly written system prompt.
- For vision and audio: preprocessing such as resizing, compression and noise, and certified approaches like randomised smoothing for high-assurance uses.
Suggested evidence
- The hardening measures in place.
- Before-and-after test results.
- The residual risk note.
Common mistakes
- Claiming the model is hardened without measuring anything.
- Hardening against one attack family and reporting the result as general robustness.
- Ignoring the cost in normal accuracy, then having the measure switched off when users complain.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.