Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model Alignment, Safety, and Robustness Testing and Training
Report adversarial results alongside normal ones
Verify that adversarial evaluation results are reported alongside results for the same tasks, scored the same way, with no attack applied.
OWASP AISVS v1.01, requirement 11.1.6
In plain English
Report results under attack next to results for the same tasks with no attack, scored the same way. "The attack succeeded 12% of the time" means little alone. The reader needs the clean baseline to see how big the drop is.
What good looks like
- Every adversarial result has a matching clean result on the same tasks.
- Both are scored with the same method and the same evaluator.
- Reports show the two side by side.
- The same applies when comparing defences: each is reported with its effect on clean performance.
How teams usually do it
- Run each evaluation task in clean and attacked form in the same job, with the same grader.
- A standard report template with both columns and the difference.
Suggested evidence
- Evaluation reports showing clean and adversarial results together.
- The evaluation configuration, showing identical scoring.
Common mistakes
- Reporting attack success rates with no baseline.
- Scoring clean runs with one grader and attacked runs with another.
- Reporting a defence's drop in attack success and leaving out its drop in normal usefulness.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.