Input Validation and Prompt Filtering Controls
5 minutes
5 Questions
Input validation and prompt filtering controls are foundational defensive layers in AI security management, designed to inspect, sanitize, and constrain data before it reaches a model, and in many architectures, to screen model outputs as well. Their purpose is to reduce the attack surface exposed through natural language interfaces, which are inherently ambiguous and difficult to govern with traditional parsing rules. At an advanced level, input validation goes beyond simple character or length checks. It includes schema enforcement for structured inputs, encoding normalization to defeat obfuscation (such as Unicode homoglyphs, base64 payloads, or zero-width characters), language detection, and token-budget controls to prevent context-window flooding. For multimodal systems, it also covers image, audio, and document inspection, since adversarial instructions can be embedded in non-text channels. Prompt filtering targets semantic threats, most notably prompt injection and jailbreak attempts. Techniques include pattern-based detection of known attack signatures, classifier models trained to recognize adversarial intent, perplexity or anomaly scoring to flag unusual inputs, and canary or delimiter strategies that help the system distinguish trusted system instructions from untrusted user or retrieved content. In retrieval-augmented and agentic systems, filtering must extend to indirect inputs such as web pages, emails, or tool outputs, because these can carry hidden instructions that hijack model behavior. Effective programs treat these controls as part of defense in depth rather than a standalone barrier. They are paired with least-privilege tool access, output validation, human-in-the-loop checkpoints for high-risk actions, and continuous red-teaming to update filters against evolving attack techniques. Logging and telemetry from filtering decisions feed detection and response processes and support compliance evidence. Key management challenges include balancing false positives against usability, avoiding over-reliance on brittle blocklists, handling multilingual and paraphrased attacks, and governing filter updates through change management. Mature organizations measure filter efficacy with adversarial test suites and align controls to frameworks such as the OWASP Top 10 for LLM Applications and NIST AI RMF.
Input Validation and Prompt Filtering Controls (ISACA AAISM - AI Technologies and Controls)
Overview
Input validation and prompt filtering controls are the first line of technical defense for AI systems, particularly large language model (LLM) and generative AI applications. In the ISACA Advanced in AI Security Management (AAISM) body of knowledge, this topic sits within the AI Technologies and Controls domain and connects closely to AI risk management, AI governance and the broader security management program. This guide explains why these controls matter, what they are, how they operate in practice, and how to reason through exam questions about them.
1. Why Input Validation and Prompt Filtering Matter
Traditional applications accept structured inputs (fields, parameters, API payloads) that can be validated against known formats. AI systems, especially LLMs, accept unstructured natural language, images, documents and retrieved content. This dramatically expands the attack surface because:
- The model cannot reliably distinguish between instructions from the developer and data supplied by a user or third party. This is the root cause of prompt injection.
- Malicious inputs can manipulate model behavior to leak system prompts, exfiltrate sensitive data, bypass safety policies (jailbreaking), generate harmful content, or trigger unsafe actions in connected tools and agents.
- Indirect inputs (web pages, emails, PDFs, retrieval-augmented generation sources) can carry hidden instructions that the user never sees.
- Oversized or adversarially crafted inputs can cause resource exhaustion, cost spikes and denial of service.
- Regulatory and ethical expectations (EU AI Act, NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications) require organizations to demonstrate that AI systems are protected against misuse and produce trustworthy outputs.
From a management perspective, input controls are a cost-effective preventive measure: stopping a malicious prompt before it reaches the model is far cheaper than detecting and remediating a harmful output, data breach or reputational incident afterward.
2. What the Controls Are
Input validation is the process of verifying that data entering an AI system conforms to expected type, format, size, encoding and content rules before it is processed. It is a long-standing secure development principle (never trust input) adapted to AI pipelines.
Prompt filtering is the specialized inspection of natural language prompts (and other model inputs) to detect and block or sanitize content that is malicious, policy-violating, sensitive or out of scope. It is often implemented as a guardrail layer that sits between the user or data source and the model.
Key distinctions the exam may test:
- Validation is typically rule-based and deterministic (schema, length, character set, allow lists). Filtering often adds probabilistic or semantic techniques (classifiers, embeddings, secondary LLM judges).
- Input controls act before inference; output controls (response filtering, moderation, redaction) act after inference. Both are needed for defense in depth.
- Direct prompt injection comes from the user interacting with the model; indirect prompt injection arrives through content the model consumes (documents, websites, tool results). Filtering must address both channels.
3. How the Controls Work
A mature input validation and prompt filtering architecture is layered. Common components include:
a) Structural and syntactic validation
- Enforce maximum prompt length and token limits to prevent context flooding and cost abuse.
- Validate data types, schemas and parameter ranges for API calls and function-calling arguments.
- Normalize and canonicalize encoding (Unicode normalization, removing zero-width or homoglyph characters) so that obfuscated attacks cannot slip past pattern checks.
- Reject or sanitize unexpected file types, embedded scripts, macros or malformed multimodal inputs.
b) Allow lists, deny lists and pattern matching
- Allow lists define permitted topics, commands or formats (preferred because they are restrictive by default).
- Deny lists and regular expressions catch known jailbreak phrases, instruction override attempts (for example, phrases asking the model to ignore previous instructions), encoded payloads and sensitive data patterns such as credit card or national ID formats.
- Limitation: attackers paraphrase, translate or encode prompts, so signature-based filtering alone is insufficient.
c) Semantic and ML-based classifiers
- Dedicated classifiers or embedding similarity checks score prompts for toxicity, hate, self-harm, sexual content, violence, prompt injection likelihood and off-topic intent.
- A secondary moderation model or LLM-as-judge evaluates whether the input attempts to subvert the system prompt.
- Thresholds are tuned to balance false positives (blocking legitimate users) and false negatives (missing attacks).
d) Prompt structure and privilege separation
- Clear delimiters and structured prompt templates separate trusted system instructions from untrusted user or retrieved content.
- The system prompt instructs the model to treat embedded content as data, not commands, and to never reveal its own instructions.
- Least privilege is applied to tools and plugins so that even a successful injection has limited blast radius.
e) Data sanitization and privacy filtering
- Detect and redact personally identifiable information, credentials, secrets and confidential documents before they reach the model or are logged.
- Enforce data classification policies so regulated data is not sent to external model providers.
f) Indirect input controls for RAG and agents
- Scan retrieved documents and web content for injected instructions before adding them to the context window.
- Sign, hash or source-verify knowledge base content; restrict retrieval to trusted repositories.
- Require human confirmation for high-risk tool actions triggered by model output.
g) Rate limiting and abuse detection
- Throttle requests per user, session and API key; detect automated probing and repeated jailbreak attempts.
- Correlate input anomalies with identity and behavioral analytics.
h) Logging, monitoring and feedback loops
- Log blocked and allowed prompts (with privacy safeguards) to support incident response, red teaming and continuous tuning.
- Track metrics such as block rate, false positive rate, escalation volume and time to update filters after new attack patterns emerge.
- Feed red-team findings and production incidents back into filter rules and classifier training.
4. Management and Governance Considerations
AAISM is a management-level certification, so the exam emphasizes how a security leader selects, justifies and oversees controls rather than how to write code. Key management responsibilities include:
- Performing a risk assessment that identifies input-based threats (prompt injection, data leakage, harmful content, DoS) and rating them by likelihood and impact for each AI use case.
- Defining acceptable use and content policies that the filtering layer enforces.
- Choosing a defense-in-depth design: input controls, output controls, model-level alignment, access control and monitoring together, never relying on a single filter.
- Mapping controls to frameworks such as OWASP LLM Top 10 (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM10 Unbounded Consumption), NIST AI RMF (Measure and Manage functions), ISO/IEC 42001 and ISO/IEC 27001 Annex A secure development controls.
- Addressing third-party and shared responsibility: when using a vendor model or API, determine which filters the provider supplies and which the organization must add.
- Balancing security with usability and fairness: overly aggressive filtering can degrade user experience and may disproportionately block certain languages or communities, creating bias and ethical issues.
- Establishing testing: adversarial testing, red teaming and regression testing of guardrails before deployment and after model or prompt changes.
- Ensuring continuous improvement, because attack techniques evolve quickly and static filters decay in effectiveness.
5. Limitations and Common Misconceptions
- No filter is complete. Natural language is infinitely variable; determined attackers will eventually find bypasses. Filtering reduces risk; it does not eliminate it.
- Filtering is not a substitute for least privilege, output validation or human oversight of consequential actions.
- System prompt instructions alone (for example, telling the model to refuse harmful requests) are a weak control and should not be considered a complete prompt filtering mechanism.
- Logging prompts can itself create privacy risk; logs must be classified, protected and retained according to policy.
- Filters introduce latency and cost; management must weigh these against the risk reduction achieved.
6. Exam Tips: Answering Questions on Input Validation and Prompt Filtering Controls
Tip 1 - Identify the threat first. Many questions describe a scenario (a chatbot revealing its system prompt, an agent emailing data after reading a malicious web page, a user bypassing content rules with encoded text). First name the threat (direct injection, indirect injection, jailbreak, data exfiltration, resource abuse), then pick the control that most directly addresses it.
Tip 2 - Prefer preventive, layered answers. When two options seem plausible, the one that prevents the malicious input from reaching the model or that adds a complementary layer is usually stronger than a detective or after-the-fact option. However, if the question asks for the most effective overall approach, choose defense in depth rather than a single filter.
Tip 3 - Distinguish input from output controls. If the scenario is about what the model produces (toxic responses, leaked PII in answers), the answer involves output filtering or moderation. If it is about what enters the model, the answer involves input validation or prompt filtering. Watch the wording carefully.
Tip 4 - Allow lists beat deny lists. In secure design questions, restricting inputs to known good patterns is considered stronger than blocking known bad patterns, because deny lists cannot anticipate novel attacks.
Tip 5 - Indirect injection requires content-source controls. If untrusted documents, websites or tool outputs are the attack vector, the best answers involve scanning retrieved content, trusting only verified sources, separating data from instructions, and limiting the privileges of downstream actions.
Tip 6 - Think like a manager, not a developer. AAISM questions often ask what the AI security manager should do FIRST or what is MOST important. Typical best answers: conduct a risk assessment, define policy requirements, establish acceptance criteria and testing, assign ownership, or ensure monitoring and metrics. Technical specifics usually come after governance steps.
Tip 7 - Recognize weak controls. Options that rely solely on instructing the model to behave, on user training, or on a single keyword list are typically distractors when stronger architectural controls are listed.
Tip 8 - Remember false positives and fairness. If a question raises user complaints, blocked legitimate requests or bias concerns, the answer involves tuning thresholds, measuring false positive rates, testing across languages and demographics, and providing an appeal or escalation path, not simply tightening the filter.
Tip 9 - Shared responsibility with vendors. For questions on third-party AI services, the correct answer usually acknowledges that provider-side filters exist but the organization remains accountable and must implement its own validation for its specific data and use case.
Tip 10 - Connect to frameworks. Be ready to associate prompt injection with OWASP LLM01, sensitive disclosure with LLM02, resource exhaustion with unbounded consumption, and the overall control lifecycle with NIST AI RMF Measure and Manage functions and ISO/IEC 42001 operational controls.
Tip 11 - Watch qualifier words. BEST, MOST, FIRST, PRIMARY and GREATEST change the correct answer. Eliminate options that are true but not the best fit for the qualifier.
7. Worked Example
Scenario: An organization deploys a customer service assistant that uses retrieval-augmented generation over product manuals and public web pages. During testing, a web page containing hidden text caused the assistant to instruct users to visit a phishing site. Which control would MOST effectively mitigate this risk?
Reasoning: The vector is indirect prompt injection via retrieved content. Options such as training users, adding a disclaimer, or adding a keyword deny list on user prompts do not address the retrieved content. The strongest answer is to scan and sanitize retrieved content for embedded instructions, restrict retrieval to trusted and verified sources, and enforce separation of data from instructions in the prompt template, supported by output filtering for suspicious URLs.
8. Key Takeaways
- Input validation and prompt filtering are preventive, first-line controls for AI systems that face unstructured and untrusted inputs.
- They combine deterministic validation (length, type, encoding, allow lists) with semantic filtering (classifiers, LLM judges) and architectural measures (instruction and data separation, least privilege, trusted sources).
- They must cover both direct and indirect input channels and be paired with output controls, monitoring, red teaming and governance.
- In the exam, identify the threat, favor layered preventive controls, distinguish input from output, think at the management level, and respect qualifier words.
Input validation and prompt filtering controls are the first line of technical defense for AI systems, particularly large language model (LLM) and generative AI applications. In the ISACA Advanced in AI Security Management (AAISM) body of knowledge, this topic sits within the AI Technologies and Controls domain and connects closely to AI risk management, AI governance and the broader security management program. This guide explains why these controls matter, what they are, how they operate in practice, and how to reason through exam questions about them.
1. Why Input Validation and Prompt Filtering Matter
Traditional applications accept structured inputs (fields, parameters, API payloads) that can be validated against known formats. AI systems, especially LLMs, accept unstructured natural language, images, documents and retrieved content. This dramatically expands the attack surface because:
- The model cannot reliably distinguish between instructions from the developer and data supplied by a user or third party. This is the root cause of prompt injection.
- Malicious inputs can manipulate model behavior to leak system prompts, exfiltrate sensitive data, bypass safety policies (jailbreaking), generate harmful content, or trigger unsafe actions in connected tools and agents.
- Indirect inputs (web pages, emails, PDFs, retrieval-augmented generation sources) can carry hidden instructions that the user never sees.
- Oversized or adversarially crafted inputs can cause resource exhaustion, cost spikes and denial of service.
- Regulatory and ethical expectations (EU AI Act, NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLM Applications) require organizations to demonstrate that AI systems are protected against misuse and produce trustworthy outputs.
From a management perspective, input controls are a cost-effective preventive measure: stopping a malicious prompt before it reaches the model is far cheaper than detecting and remediating a harmful output, data breach or reputational incident afterward.
2. What the Controls Are
Input validation is the process of verifying that data entering an AI system conforms to expected type, format, size, encoding and content rules before it is processed. It is a long-standing secure development principle (never trust input) adapted to AI pipelines.
Prompt filtering is the specialized inspection of natural language prompts (and other model inputs) to detect and block or sanitize content that is malicious, policy-violating, sensitive or out of scope. It is often implemented as a guardrail layer that sits between the user or data source and the model.
Key distinctions the exam may test:
- Validation is typically rule-based and deterministic (schema, length, character set, allow lists). Filtering often adds probabilistic or semantic techniques (classifiers, embeddings, secondary LLM judges).
- Input controls act before inference; output controls (response filtering, moderation, redaction) act after inference. Both are needed for defense in depth.
- Direct prompt injection comes from the user interacting with the model; indirect prompt injection arrives through content the model consumes (documents, websites, tool results). Filtering must address both channels.
3. How the Controls Work
A mature input validation and prompt filtering architecture is layered. Common components include:
a) Structural and syntactic validation
- Enforce maximum prompt length and token limits to prevent context flooding and cost abuse.
- Validate data types, schemas and parameter ranges for API calls and function-calling arguments.
- Normalize and canonicalize encoding (Unicode normalization, removing zero-width or homoglyph characters) so that obfuscated attacks cannot slip past pattern checks.
- Reject or sanitize unexpected file types, embedded scripts, macros or malformed multimodal inputs.
b) Allow lists, deny lists and pattern matching
- Allow lists define permitted topics, commands or formats (preferred because they are restrictive by default).
- Deny lists and regular expressions catch known jailbreak phrases, instruction override attempts (for example, phrases asking the model to ignore previous instructions), encoded payloads and sensitive data patterns such as credit card or national ID formats.
- Limitation: attackers paraphrase, translate or encode prompts, so signature-based filtering alone is insufficient.
c) Semantic and ML-based classifiers
- Dedicated classifiers or embedding similarity checks score prompts for toxicity, hate, self-harm, sexual content, violence, prompt injection likelihood and off-topic intent.
- A secondary moderation model or LLM-as-judge evaluates whether the input attempts to subvert the system prompt.
- Thresholds are tuned to balance false positives (blocking legitimate users) and false negatives (missing attacks).
d) Prompt structure and privilege separation
- Clear delimiters and structured prompt templates separate trusted system instructions from untrusted user or retrieved content.
- The system prompt instructs the model to treat embedded content as data, not commands, and to never reveal its own instructions.
- Least privilege is applied to tools and plugins so that even a successful injection has limited blast radius.
e) Data sanitization and privacy filtering
- Detect and redact personally identifiable information, credentials, secrets and confidential documents before they reach the model or are logged.
- Enforce data classification policies so regulated data is not sent to external model providers.
f) Indirect input controls for RAG and agents
- Scan retrieved documents and web content for injected instructions before adding them to the context window.
- Sign, hash or source-verify knowledge base content; restrict retrieval to trusted repositories.
- Require human confirmation for high-risk tool actions triggered by model output.
g) Rate limiting and abuse detection
- Throttle requests per user, session and API key; detect automated probing and repeated jailbreak attempts.
- Correlate input anomalies with identity and behavioral analytics.
h) Logging, monitoring and feedback loops
- Log blocked and allowed prompts (with privacy safeguards) to support incident response, red teaming and continuous tuning.
- Track metrics such as block rate, false positive rate, escalation volume and time to update filters after new attack patterns emerge.
- Feed red-team findings and production incidents back into filter rules and classifier training.
4. Management and Governance Considerations
AAISM is a management-level certification, so the exam emphasizes how a security leader selects, justifies and oversees controls rather than how to write code. Key management responsibilities include:
- Performing a risk assessment that identifies input-based threats (prompt injection, data leakage, harmful content, DoS) and rating them by likelihood and impact for each AI use case.
- Defining acceptable use and content policies that the filtering layer enforces.
- Choosing a defense-in-depth design: input controls, output controls, model-level alignment, access control and monitoring together, never relying on a single filter.
- Mapping controls to frameworks such as OWASP LLM Top 10 (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM10 Unbounded Consumption), NIST AI RMF (Measure and Manage functions), ISO/IEC 42001 and ISO/IEC 27001 Annex A secure development controls.
- Addressing third-party and shared responsibility: when using a vendor model or API, determine which filters the provider supplies and which the organization must add.
- Balancing security with usability and fairness: overly aggressive filtering can degrade user experience and may disproportionately block certain languages or communities, creating bias and ethical issues.
- Establishing testing: adversarial testing, red teaming and regression testing of guardrails before deployment and after model or prompt changes.
- Ensuring continuous improvement, because attack techniques evolve quickly and static filters decay in effectiveness.
5. Limitations and Common Misconceptions
- No filter is complete. Natural language is infinitely variable; determined attackers will eventually find bypasses. Filtering reduces risk; it does not eliminate it.
- Filtering is not a substitute for least privilege, output validation or human oversight of consequential actions.
- System prompt instructions alone (for example, telling the model to refuse harmful requests) are a weak control and should not be considered a complete prompt filtering mechanism.
- Logging prompts can itself create privacy risk; logs must be classified, protected and retained according to policy.
- Filters introduce latency and cost; management must weigh these against the risk reduction achieved.
6. Exam Tips: Answering Questions on Input Validation and Prompt Filtering Controls
Tip 1 - Identify the threat first. Many questions describe a scenario (a chatbot revealing its system prompt, an agent emailing data after reading a malicious web page, a user bypassing content rules with encoded text). First name the threat (direct injection, indirect injection, jailbreak, data exfiltration, resource abuse), then pick the control that most directly addresses it.
Tip 2 - Prefer preventive, layered answers. When two options seem plausible, the one that prevents the malicious input from reaching the model or that adds a complementary layer is usually stronger than a detective or after-the-fact option. However, if the question asks for the most effective overall approach, choose defense in depth rather than a single filter.
Tip 3 - Distinguish input from output controls. If the scenario is about what the model produces (toxic responses, leaked PII in answers), the answer involves output filtering or moderation. If it is about what enters the model, the answer involves input validation or prompt filtering. Watch the wording carefully.
Tip 4 - Allow lists beat deny lists. In secure design questions, restricting inputs to known good patterns is considered stronger than blocking known bad patterns, because deny lists cannot anticipate novel attacks.
Tip 5 - Indirect injection requires content-source controls. If untrusted documents, websites or tool outputs are the attack vector, the best answers involve scanning retrieved content, trusting only verified sources, separating data from instructions, and limiting the privileges of downstream actions.
Tip 6 - Think like a manager, not a developer. AAISM questions often ask what the AI security manager should do FIRST or what is MOST important. Typical best answers: conduct a risk assessment, define policy requirements, establish acceptance criteria and testing, assign ownership, or ensure monitoring and metrics. Technical specifics usually come after governance steps.
Tip 7 - Recognize weak controls. Options that rely solely on instructing the model to behave, on user training, or on a single keyword list are typically distractors when stronger architectural controls are listed.
Tip 8 - Remember false positives and fairness. If a question raises user complaints, blocked legitimate requests or bias concerns, the answer involves tuning thresholds, measuring false positive rates, testing across languages and demographics, and providing an appeal or escalation path, not simply tightening the filter.
Tip 9 - Shared responsibility with vendors. For questions on third-party AI services, the correct answer usually acknowledges that provider-side filters exist but the organization remains accountable and must implement its own validation for its specific data and use case.
Tip 10 - Connect to frameworks. Be ready to associate prompt injection with OWASP LLM01, sensitive disclosure with LLM02, resource exhaustion with unbounded consumption, and the overall control lifecycle with NIST AI RMF Measure and Manage functions and ISO/IEC 42001 operational controls.
Tip 11 - Watch qualifier words. BEST, MOST, FIRST, PRIMARY and GREATEST change the correct answer. Eliminate options that are true but not the best fit for the qualifier.
7. Worked Example
Scenario: An organization deploys a customer service assistant that uses retrieval-augmented generation over product manuals and public web pages. During testing, a web page containing hidden text caused the assistant to instruct users to visit a phishing site. Which control would MOST effectively mitigate this risk?
Reasoning: The vector is indirect prompt injection via retrieved content. Options such as training users, adding a disclaimer, or adding a keyword deny list on user prompts do not address the retrieved content. The strongest answer is to scan and sanitize retrieved content for embedded instructions, restrict retrieval to trusted and verified sources, and enforce separation of data from instructions in the prompt template, supported by output filtering for suspicious URLs.
8. Key Takeaways
- Input validation and prompt filtering are preventive, first-line controls for AI systems that face unstructured and untrusted inputs.
- They combine deterministic validation (length, type, encoding, allow lists) with semantic filtering (classifiers, LLM judges) and architectural measures (instruction and data separation, least privilege, trusted sources).
- They must cover both direct and indirect input channels and be paired with output controls, monitoring, red teaming and governance.
- In the exam, identify the threat, favor layered preventive controls, distinguish input from output, think at the management level, and respect qualifier words.
Test mode:
AAISM - Input Validation and Prompt Filtering Controls Example Questions
Test your knowledge of Input Validation and Prompt Filtering Controls
Question 1
Input validation and prompt filtering applied to user-submitted text in a large language model (LLM) application are PRIMARILY intended to reduce which threat?
Question 2
An enterprise's LLM assistant uses retrieval-augmented generation to pull inbound supplier emails into its context and summarize them for staff. Input validation and prompt filtering screen every message employees submit, and logs show those messages are clean and low in volume. Even so, after processing certain emails that contain hidden instructions, the assistant began sending internal pricing data to external addresses. Which gap BEST explains why the existing filtering control failed to stop this?
Question 3
An enterprise has launched a customer support assistant built on a large language model (LLM). Log reviews show users sending messages that tell the model to override its prior instructions and reveal its system prompt and internal pricing rules. The information security manager must choose a control that acts on this behavior at the point where it enters the application. Which control is BEST?
Unlock Premium Access
Advanced in AI Security Management
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3073 Superior-grade Advanced in AI Security Management practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- AAISM: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Input Validation and Prompt Filtering Controls questions
21 questions (total)
Other AI Technologies and Controls concepts
AI Architecture Within Enterprise ArchitectureAI Development Life Cycle Security TouchpointsAI System Components and Attack SurfaceAPI Security for AI ServicesArchitecture Review and Security Sign-Off for AIContent Safety Filters and GuardrailsControl Testing, Assurance and Continuous ValidationCross-Border Data Transfer and Residency for AIData Access Controls and Segregation for AI PipelinesData Classification and Handling for AIData Leakage Prevention for AI Inputs and OutputsData Minimization, Anonymization and PseudonymizationData Provenance, Lineage and Labeling ControlsData Quality, Integrity and Validation ControlsData Retention, Deletion and Unlearning RequestsDetection and Response Integration for AI SystemsEncryption of AI Data at Rest, in Transit and in UseEthical Review and Responsible AI AssessmentExplainability and Interpretability ControlsFairness and Bias Testing ControlsFine-Tuning and Prompt Engineering SecurityIdentity and Access Management for Models and DataKill Switches, Circuit Breakers and Fallback ModesLogging, Auditing and Traceability of AI InteractionsMaintenance, Retraining and Drift ResponseMapping Security Controls to AI RiskMLOps and LLMOps Security ControlsModel Cards, Datasheets and AI DocumentationModel Decommissioning and Secure RetirementModel Selection: Build, Buy, Fine-Tune or PromptModel Validation, Testing and Acceptance CriteriaModel Versioning, Change Management and RollbackMonitoring Model Behavior and Anomaly DetectionOutput Filtering, Moderation and ValidationPre-Deployment Security Testing of AI ModelsPreventive, Detective and Corrective Controls for AIPrivacy by Design for AI SystemsPrivacy-Enhancing Technologies for AIRate Limiting, Quotas and Abuse PreventionRisk-Based Human Oversight of AI Inputs and OutputsRobustness and Reliability ControlsSecrets, Keys and Model Artifact ProtectionSecure Deployment and Release of AI ModelsSecure Deployment: Cloud, On-Premises and Edge AISecure Training Environments and PipelinesSecuring AI Agents, Tools and PluginsSecuring LLM Applications and RAG PipelinesSecurity Architecture Patterns for AI ApplicationsSecurity by Design and Threat-Informed RequirementsSecurity Metrics and Dashboards for AI ControlsSynthetic Data and Its Security ImplicationsTraining Data Security and Integrity ControlsTransparency, Disclosure and User NotificationTrust and Safety Operations for Generative AIZero Trust and Segmentation for AI Workloads