Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Isolate on-device inference
Verify that inference runtimes enforce process, memory, and file access isolation.
OWASP AISVS v1.01, requirement 4.3.3
In plain English
On a device, run the inference runtime in its own isolated process, with access only to the memory and files it needs. Model parsers and runtimes have bugs, and a malicious model or input should not be able to reach the rest of the app or the device.
What good looks like
- The inference runtime runs in a separate process or sandbox from the main application.
- It can read only its model files and the inputs passed to it.
- Other apps and processes cannot read its memory.
- It has no network access unless the design needs it.
How teams usually do it
- Platform sandboxing: an isolated process on Android, app sandbox and entitlements on Apple platforms, containers or systemd sandboxing with seccomp on embedded Linux.
- Running the model in a WebAssembly runtime for a tight, portable sandbox.
- A trusted execution environment such as Arm TrustZone for the most sensitive models.
Suggested evidence
- Runtime configuration and platform permission settings.
- A test showing the runtime cannot read files outside its allowed set.
Common mistakes
- Running inference inside the main app process with every permission the app holds.
- Giving the inference process network access "for telemetry".
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.