Testing and verification
Testing and verification for traditional applications are well understood, and standards such as the OWASP ASVS provide a comprehensive guide.
However, AI introduces new challenges in testing and verifying security in AI solutions. These entail the following:
- Third-party model benchmarking and verification
- Data anomaly testing
- Adversarial robustness
A more recent verification standard is the OWASP LLM Verification Standard (OWASP LLMVS), which aims to produce the equivalent of the popular OWASP AVS standard
The standard’s core is a security-assurance level classification driven by data sensitivity. There are three levels of security assurance: Basic (Level 1), Moderate (Level 2), and High Assurance (Level 3). Depending on the applicable level, the standard offers a range of verification activities. These cover various aspects of LLM security, including secure configuration and maintenance, model life cycle, real-time learning...
