Insecure Output Handling

Downstream component се доверява на LLM output като на safe code/query/HTML/command .

1 обява в България

Какво е

Downstream component се доверява на LLM output като на safe code/query/HTML/command.

Как работи

Model може да генерира съдържание, което включва injection payload или unsafe instruction, а application го изпълнява без validation.

Как да се предотврати

Treat LLM output as untrusted input, parameterized downstream APIs, escaping/sanitization по context, allow-listed actions и sandboxing.

Най-ефективни защити

Подредени по приоритет — P0 е мястото, от което се започва.

Treat LLM output as untrusted · P0
Secure SDLC + threat modeling · P1

Всички защити

Източници

OWASP GenAI Security Project, Top 10 for LLM and GenAI.

Други в AI, ML и LLM атаки

Direct Prompt Injection Indirect Prompt Injection Jailbreaking System-Prompt / Hidden-Instruction Leakage Sensitive Information Disclosure by LLM Training-Data Poisoning Model Poisoning / Backdoored Model RAG / Vector-Database Poisoning Model Extraction / Model Stealing Model Inversion Membership Inference Adversarial Example / Evasion Attack Excessive Agency / Tool Abuse AI/Model Supply-Chain Compromise Unbounded Consumption / Model DoS Agent Hijacking Persistent AI Memory/Context Poisoning Retrieval Hijacking / Search Manipulation for AI AI-Assisted Social Engineering