Input Validation · Prompt Injection Defenses
Screen inputs for prompt injection
Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.
OWASP AISVS v1.01, requirement 2.1.3
In plain English
Anything that ends up in the prompt can carry instructions. That includes the user's message, uploaded files, documents found by search, web pages and tool results. Treat all of it as untrusted, run it past a prompt injection detector before it reaches the model, and block what gets flagged.
What good looks like
- Every route into the prompt is listed: the chat box, uploads, retrieved documents, web pages, emails, and tool and MCP responses.
- A detector checks each of those routes before the prompt is put together.
- Flagged input is blocked, the person sees a neutral message, and the event is logged.
- Thresholds are set on purpose and reviewed against real false-positive data.
How teams usually do it
- Managed guardrails from your model platform, for example Azure AI Content Safety Prompt Shields or the prompt attack filter in Amazon Bedrock Guardrails.
- An open classifier run in your own stack, for example Meta's Prompt Guard, or a specialist vendor API.
- Simple rules for known attack phrases as a cheap first layer in front of the classifier. Rules alone are too easy to rephrase around.
Suggested evidence
- A data-flow diagram showing every input route and where screening happens.
- The detector configuration and thresholds.
- Results from a prompt injection test set, with block rate and false-positive rate.
- Sample log entries for blocked inputs.
Common mistakes
- Screening the user's message and skipping retrieved documents and tool output. For search-based assistants and agents, injection hidden in content is the larger risk.
- Treating detection as the whole defence. Every detector misses some attacks, so pair this with 2.1.6 and keep tool permissions tight.
- Flagging suspicious input and letting it through anyway.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.