Atlas › 07 Security Testing for AI Apps › Insecure Output Handling and Model Denial of Service☰ Read as one page
Insecure Output Handling and Model Denial of Service
2.1LLM02: Insecure Output HandlingLLM output is often trusted and used in downstream operations without validation. When the model's output is interpolated into SQL queries…2.2The Core ProblemTraditional input validation protects against user-supplied malicious input. But when an LLM generates the output, developers often skip…2.3Testing Insecure Output Handling2.4Output Validation Framework2.5LLM04: Model Denial of ServiceCrafted inputs can consume excessive resources -- large context windows, recursive reasoning loops, or token-intensive outputs.2.6Cost-Based Denial of ServiceA unique AI threat: an attacker can cause financial damage by triggering expensive operations:2.7Defense Checklist for Output Handling- [ ] All LLM output rendered in HTML is escaped - [ ] All LLM output used in SQL uses parameterized queries - [ ] All LLM output used in…