Click On The Cheat Sheet To Download A PDF.pdf

Top considerations for addressing risks in the OWASP Top 10 for LLMs include:
1. Prompt injection: manipulate LLMs with malicious inputs, mitigated by educating teams, using least privilege, and sanitizing actions and responses.
2. Model Denial of Service (MDoS): malicious inputs consume system resources, mitigated by restricting input evaluation, following architecture best practices, and sanitizing input.
3. Sensitive information disclosure: LLMs disclose sensitive data, mitigated by limiting data access and adding input/output guard checks.
4. Insecure output handling: LLMs access sensitive data or execute functions without validation, mitigated by treating LLMs like user data and adhering to least privilege rules.
5. Supply chain vulnerabilities: vulnerabilities in training or tuning data, mitigated by listing data source dependencies, using attestation/signing techniques, and evaluating traditional security risks.
6. Overreliance: assuming generated code is correct and secure, mitigated by validating and testing generated code, and educating teams about hallucinations and disinformation.
7. Insecure plugin design: homegrown plugins open to malicious input, mitigated by treating LLM output like user input, using param input, and following API security best practices.
8. Training data poisoning: manipulation of training data, mitigated by validating data sources, using sandboxing, and performing attestation/signing.
9. Excessive agency: LLMs invoke functionality in malicious ways, mitigated by ensuring sufficient functionality granularity, limiting access/permissions, and avoiding excessive autonomy.
10. Model theft: protecting digital IP from unauthorized access, mitigated by using existing best practices like RBAC.