Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Respond to suspected extraction
Verify that detection of suspected extraction triggers response measures.
OWASP AISVS v1.01, requirement 11.3.4
In plain English
When extraction is suspected, the system should respond automatically. A detector that only writes a report gives the attacker weeks to finish. This is a Level 3 control.
What good looks like
- Response measures for suspected extraction are defined in advance and graded by confidence.
- They trigger automatically from the detector.
- A person reviews each case promptly and can reverse a wrong call.
- Evidence is preserved for contract or legal action.
How teams usually do it
- Detector alerts wired to the API gateway: throttle first, then require re-verification, then block.
- Reducing output detail for flagged callers (see 11.3.2).
- Terms of service that prohibit extraction, so there is a contractual basis for acting.
Suggested evidence
- Response rules.
- Logs of triggered responses and the reviews that followed.
Common mistakes
- Detection that only feeds a weekly report.
- Blocking outright on weak signals and cutting off real customers.
- No route for a wrongly flagged customer to appeal.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.