Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · Model Artifact Integrity
Acceptance-test models before promotion
Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.
OWASP AISVS v1.01, requirement 6.1.4
In plain English
Before a model leaves development, test how it behaves. A file scan finds malicious code. It cannot find a backdoor trained into the weights, or behaviour that falls short of your safety rules. Only running the model shows those.
What good looks like
- A behavioural test suite runs before a model is promoted to staging, test or production.
- The suite covers safety behaviour, known attack prompts and the tasks you will use the model for.
- Results are compared with the model it replaces or with the publisher's claims.
- A failure blocks promotion.
How teams usually do it
- Run the same evaluation suite as 3.2.1 on third-party models as part of import.
- Add probes for hidden triggers: unusual tokens, rare phrases and inputs associated with the publisher or the model's stated domain. Scanners such as garak include some of these.
- Run the tests in an isolated environment, since the model is still untrusted.
Suggested evidence
- Test results attached to the promotion record.
- The pass criteria.
- A promotion that was refused, or a pipeline rule showing a failure blocks it.
Common mistakes
- Promoting third-party models to staging untested because "staging is not production". Staging often holds real data and credentials.
- Assuming a popular model is safe because many others use it.
- Testing the base model and skipping an adapter downloaded separately.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.