Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Membership-Inference and Model-Inversion Mitigation
Don't reveal attributes the model inferred
Verify that model-inferred sensitive attributes are not directly returned in outputs.
OWASP AISVS v1.01, requirement 11.2.1
In plain English
Models can guess sensitive things about a person from innocuous data: health conditions, religion, sexuality, political views. Do not return those guesses in output. An inferred attribute is still personal data, and often special-category data in law.
What good looks like
- The sensitive attribute categories are listed.
- The product is designed so the model is not asked to infer them.
- Outputs are checked for inferred values in those categories and such content is removed or blocked.
- The rule covers classification models as well as generated text.
How teams usually do it
- Leave sensitive attributes out of prompts, profile schemas and classifier outputs unless there is a lawful, documented need.
- Output filters or a classifier for the listed categories.
- Returning a decision or score and keeping the inferred attribute inside the system where a feature truly depends on one.
Suggested evidence
- The category list.
- Filter tests.
- A review of API and output schemas for sensitive inferred fields.
Common mistakes
- A profile or personalisation feature that "helpfully" guesses personal characteristics.
- Exposing internal classifier labels through an API or in logs that customers can see.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.