Implementation guide
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Controlled Deployment & Rollback
Isolate model versions running side by side
Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.
OWASP AISVS v1.01, requirement 3.3.3
In plain English
When two model versions run side by side, as in a canary or A/B test, give each its own caches, memory and other AI runtime state. Shared state lets a faulty or compromised version contaminate the stable one, and makes test results meaningless.
What good looks like
- Each version has its own prompt and response caches, conversation memory and session state.
- Shared infrastructure, such as a vector database or key-value cache, is partitioned by deployment.
- A test confirms that data written by one version cannot be read by the other.
How teams usually do it
- A separate namespace or key prefix per deployment, including the model version in every cache key.
- Separate cache instances for the canary and the stable version where the stakes are higher.
- Separate vector indexes whenever the two versions use different embedding models, since their vectors are not comparable.
Suggested evidence
- Configuration showing the separation.
- Results of the cross-version read test.
Common mistakes
- A shared response cache that serves one version's output to users of the other.
- A KV cache or prefix cache shared across versions on the same inference server.
- Agent memory written by the canary and read by the stable version after the canary is withdrawn.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.