Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Workload Sandboxing & Validation
Attest the environment before loading a model
Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.
OWASP AISVS v1.01, requirement 4.1.3
In plain English
Before a model is loaded, obtain cryptographic proof from the hardware that the machine and software stack are what you expect and have not been altered. This is workload attestation. It is a Level 3 control for high-value models and sensitive data.
What good looks like
- The environment produces an attestation report, signed by the hardware, before any model is loaded.
- A separate service checks the report against expected measurements and only then releases the model decryption key.
- A failed or missing attestation stops the workload.
- Expected measurements are updated through change control when the software stack changes.
How teams usually do it
- Confidential virtual machines or containers on AMD SEV-SNP or Intel TDX, with the cloud's attestation service (for example Azure Attestation or Google Cloud's confidential computing attestation).
- A key broker or key management policy that releases keys only on a valid attestation. Confidential Containers and similar projects package this pattern.
- SPIFFE/SPIRE node and workload attestation where you need verified workload identity without full confidential computing.
Suggested evidence
- The attestation policy and the expected measurements.
- Logs of successful checks tied to key releases.
- A test where an altered image fails attestation and gets no key.
Common mistakes
- Collecting attestation reports and releasing keys whether or not they pass.
- Checking the report inside the same environment that produced it.
- Letting expected measurements go stale, so every deployment fails and someone turns the check off.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.