Input Validation · Prompt Injection Defenses
Catch encoding tricks hidden in input
Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.
OWASP AISVS v1.01, requirement 2.1.2
In plain English
Attackers hide instructions with encodings and formatting tricks: Base64, look-alike letters, invisible characters, white-on-white text in a document. Detect these before the input reaches the model, then decode and re-check the content, reject it, or mark it clearly as untrusted.
What good looks like
- Common encodings (Base64, hex, URL encoding, HTML entities) are detected in input and either decoded and re-screened or rejected.
- Decoding repeats until nothing more decodes, up to a fixed depth, so nested encodings are caught.
- Structured input is validated against a strict schema that rejects unknown fields.
- Text extracted from documents leaves out hidden layers, comments, metadata and text styled to be invisible.
How teams usually do it
- A decode-and-rescan step in the input layer that feeds decoded text through the same injection checks as plain text.
- Document converters set to drop comments, tracked changes, speaker notes and metadata. For PDFs and web pages, compare extracted text with what a person would see.
- A policy rule that refuses input which is mostly encoded data when the use case has no need for it.
Suggested evidence
- Test cases covering encoded, nested and hidden instructions, with results.
- The extraction and decoding configuration.
- Log entries showing a blocked or flagged smuggling attempt.
Common mistakes
- Checking only the visible text of uploaded documents.
- Decoding once and missing a payload encoded twice.
- Forgetting that the model can read Base64 and similar encodings on its own. If your filter cannot read them, the filter is the weaker party.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.