Model Behavior, Output Control & Safety Assurance · Output Safety
Catch hidden or disguised output
Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.
OWASP AISVS v1.01, requirement 7.3.4
In plain English
Check model output for content that is hidden or disguised: look-alike characters, invisible text, misleading formatting, or data tucked into metadata and fields users never see. An attacker who controls part of the model's input can use these to smuggle instructions to the next system or to mislead the person reading. This is a Level 3 control.
What good looks like
- Output is normalised and scanned for invisible characters, bidirectional overrides and mixed-script look-alikes.
- Every field of structured output is validated, including ones not shown to users.
- Links are displayed so the visible text cannot differ from the true destination without the user noticing.
- Suspicious output is cleaned or blocked, and the event is logged.
How teams usually do it
- Reuse the input normalisation and character checks (2.1.1 and 2.1.5) on output.
- A confusables check for domain names and identifiers in output, using the Unicode confusables data.
- Strip metadata from generated files, and render output through a sanitiser that drops hidden elements.
Suggested evidence
- Tests with hidden, encoded and look-alike output, and their results.
- Output sanitiser configuration.
Common mistakes
- Checking only the visible text of a response.
- Passing one agent's output to another agent without these checks.
- Showing link text that the model chose while hiding the real URL.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.