CalvinBackup/www-project-ai-testing-guide
1
0
Fork 0
mirror of https://github.com/OWASP/www-project-ai-testing-guide.git synced 2026-07-16 07:57:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update 2.1.1_Architectural_Mapping_of_OWASP_Threats.md

Browse Source
This commit is contained in:
Matteo Meucci
2025-11-13 19:12:00 +01:00
committed by GitHub
parent ee374ce0ee
commit c95722eba7
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document/content/2.1.1_Architectural_Mapping_of_OWASP_Threats.md
-4
View File
@@ -189,8 +189,6 @@ For each threat, we provide an example of a threat scenario that highlights the
**Testing Strategy:** Design test prompts targeting Application (4) and Input Handling (7) to simulate real-world queries in high-stakes domains (e.g., healthcare, finance). Evaluate how Model Usage (9) responds to ambiguous or fact-sensitive prompts by assessing the factual accuracy, bias, and hallucination tendencies. Verify whether Output Handling (8) presents safeguards such as disclaimers, confidence scores, or redaction filters to alert users of unverified content. Introduce known misinformation into Training Data (16) and External Data Sources (18) in a controlled environment to measure the model’s susceptibility to replicating falsehoods. Review Data Storage Infrastructure (15) to ensure sensitive or misleading outputs are not stored without logging policies or access controls. Overall, test if each component in the flow correctly detects, flags, or mitigates misleading information before it reaches the user.
---
## **OWASP Security Threats to Tests Mapping Table**
Given the above results, the following is a table with the 20 initial threats we did extract from the OWASP Top 10 LLM 2025 and the OWASP AI Exchange Threats. We added the related test name.
@@ -217,5 +215,3 @@ Given the above results, the following is a table with the 20 initial threats we
| T01-SPL | System Prompt Leakage | LLM07 | OWASP Top 10 2025 | [link](https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/) | Testing for System Prompt Leakage (T-SPL) |
| T01-VEW | Vector & Embedding Weaknesses | LLM08 | OWASP Top 10 2025 | [link](https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/) | Testing for Embedding Manipulation (T-EMA) |
| T01-MIS | Misinformation | LLM09 | OWASP Top 10 2025 | [link](https://genai.owasp.org/llmrisk/llm092025-misinformation/) | Testing for Harmful Content Bias (T-HCB) |
---