Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Encrypt weights stored on devices
Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.
OWASP AISVS v1.01, requirement 4.3.4
In plain English
Encrypt model weights and sensitive parameters stored on a device, and keep the keys in the device's hardware key store. Anyone who gets hold of the device, or a copy of its storage, should find only ciphertext.
What good looks like
- Weights and sensitive parameters are encrypted at rest on the device.
- The encryption key is generated in or wrapped by a hardware-backed key store and cannot be exported.
- No key appears in the app package, the firmware image or a configuration file.
How teams usually do it
- Android Keystore (StrongBox where available) or the Apple Keychain with Secure Enclave keys on mobile.
- A TPM or secure element on IoT and embedded hardware.
- Envelope encryption: a data key encrypts the model, and the hardware-held key encrypts the data key.
Suggested evidence
- The storage and key management design.
- Code showing keys are created as non-exportable in the hardware store.
- A check of the app package confirming no key material is present.
Common mistakes
- Encrypting the model with a key stored next to it.
- Hard-coding the key in the app, where anyone with a decompiler can read it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.