{"owaspLlmTop10":{"version":"2025","items":[{"id":"LLM01:2025","name":"Prompt Injection","coverage":"addressed","rails":["input","retrieval"],"note":"Input rail: 2-layer injection detection (heuristics + LLM-judge). Retrieval rail: indirect-injection scanning of RAG chunks."},{"id":"LLM02:2025","name":"Sensitive Information Disclosure","coverage":"addressed","rails":["input","retrieval","output"],"note":"PII/secret masking on input and in retrieved context; egress verifier blocks leaked secrets, echoed PII and system metadata."},{"id":"LLM03:2025","name":"Supply Chain","coverage":"governance","rails":[],"note":"Zero runtime dependencies (nothing to compromise); model-agnostic upstream with no embedded provider key. Vetting upstream models/plugins remains an org control."},{"id":"LLM04:2025","name":"Data and Model Poisoning","coverage":"partial","rails":["retrieval"],"note":"Retrieval rail rejects poisoned / injection-laden context chunks at inference time. Training-data poisoning is out of scope for an inference-time guardrail."},{"id":"LLM05:2025","name":"Improper Output Handling","coverage":"addressed","rails":["output"],"note":"Output rail verifies responses for secret/PII leaks, raw SQL/error dumps and unsafe content before they reach the caller, incl. streaming."},{"id":"LLM06:2025","name":"Excessive Agency","coverage":"addressed","rails":["execution"],"note":"Execution rail risk-scores every tool call; destructive ops and off-domain data egress are denied or routed to human-in-the-loop approval."},{"id":"LLM07:2025","name":"System Prompt Leakage","coverage":"addressed","rails":["input","output"],"note":"Input rail detects system-prompt-extraction attempts; Output rail flags system-metadata / initial-prompt disclosure in responses."},{"id":"LLM08:2025","name":"Vector and Embedding Weaknesses","coverage":"partial","rails":["retrieval"],"note":"Retrieval rail guards content pulled from a vector store (injection + PII in chunks). Embedding-store access control is a data-layer concern."},{"id":"LLM09:2025","name":"Misinformation","coverage":"partial","rails":["output"],"note":"Output rail flags hallucinated tool confirmations. Full factuality/grounding checks against tool-call logs are the documented V2."},{"id":"LLM10:2025","name":"Unbounded Consumption","coverage":"addressed","rails":["core"],"note":"Per-tenant usage metering, a per-request cost ceiling on the LLM-judge, and a fail-closed circuit breaker on enforcement degradation."}],"summary":{"addressed":6,"partial":3,"governance":1}},"mitreAtlas":[{"id":"AML.T0051","name":"LLM Prompt Injection","rails":["input","retrieval"]},{"id":"AML.T0054","name":"LLM Jailbreak","rails":["input"]},{"id":"AML.T0057","name":"LLM Data Leakage","rails":["output"]},{"id":"AML.T0053","name":"LLM Plugin Compromise (unsafe tool use)","rails":["execution"]}],"governance":[{"framework":"NIST AI RMF 1.0","posture":"supports","note":"Policy-as-code (Govern), audit log + published benchmark/evals (Measure), inline rails enforcement + circuit breaker (Manage), threat-surface rail model (Map)."},{"framework":"EU AI Act","posture":"supports","note":"Provides logging/traceability, human oversight (HITL) and risk controls that high-risk-AI deployers need; not a standalone conformity solution."},{"framework":"ISO/IEC 42001 (AI Management System)","posture":"supports","note":"Operational controls: documented policy, continuous monitoring/telemetry, and audit trails for the AI system."},{"framework":"MITRE ATLAS","posture":"mapped","note":"Runtime detections mapped to ATLAS techniques (see table)."},{"framework":"India DPDP Act, 2023","posture":"supports","note":"PII detection/minimization (Aadhaar/PAN + global), data stays in-region on self-host/VPC, audit of processing. Consent/notice remain the deployer’s duty."},{"framework":"GDPR","posture":"supports","note":"Data minimization via masking, no third-party key custody, self-hostable for data residency; a DPA and lawful-basis are the controller’s responsibility."}],"disclaimer":"AIFenders is a runtime security control. It supports, but does not by itself constitute, legal or regulatory compliance — pair it with organizational policy, DPAs, and counsel review."}