Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Don't expose raw model outputs
Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.
OWASP AISVS v1.01, requirement 11.3.2
In plain English
Keep raw model outputs, such as full probability distributions, logits and embeddings, inside your backend. Return only what the use case needs. Each extra decimal place and each extra field makes a copy of the model cheaper to build.
What good looks like
- External responses contain only what the use case needs.
- Logits, log-probabilities and full score distributions are not returned unless there is a stated need.
- The amount of detail returned is set by how much extraction would hurt.
- Internal debugging fields are stripped before responses leave the backend.
How teams usually do it
- Return the top label or a rounded score in place of the full distribution.
- An explicit response schema at the API layer that lists allowed fields, so new model outputs stay internal by default.
- Disabling or restricting log-probability options on hosted model endpoints you resell.
Suggested evidence
- API response schemas.
- A sample response compared with the raw model output.
- The decision record on the level of detail.
Common mistakes
- Returning full log-probabilities because the underlying API did by default.
- Debug or verbose modes left reachable in production.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.