Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Embedding Sanitization & Validation
Reject content built to game search
Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.
OWASP AISVS v1.01, requirement 8.2.4
In plain English
Attackers write content designed to be retrieved: stuffed with likely query phrases, or tuned against the embedding model so it ranks first for chosen questions, often with instructions inside. Detect this content and reject or quarantine it before it is indexed. This is a Level 3 control.
What good looks like
- Content is checked for manipulation patterns before it is turned into vectors.
- Suspicious content is rejected or quarantined.
- External and user-supplied sources get stricter checks than internal, curated ones.
- Retrieval limits reduce the damage one bad source can do.
How teams usually do it
- Run the prompt injection classifier (2.1.3) over documents at ingestion as well as at query time.
- Spam-style signals: keyword stuffing, repeated question-like phrases, hidden text, and a mismatch between what a page shows and what is extracted.
- Retrieval safeguards: cap the chunks taken from any one source, and prefer answers supported by several independent sources.
Suggested evidence
- Ingestion checks and their test results.
- Quarantine records.
- Retrieval configuration showing per-source limits.
Common mistakes
- Indexing public web content, shared drives or inbound email with no checks.
- Checking documents at first ingestion and not when they are edited.
- Letting any user add content to a knowledge base that everyone's assistant searches.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.