LLM Security

• https://owasp.org/projects/top-10-for-large-language-model-applications
• Threat and Exploitation
  • Sensitive Information Disclosure
  • Improper Output Handling
  • Unbounded Consumption
  • System Prompt Leakage
  • Prompt Jailbreaking
• Prevention and Mitigation
  • Guardrails
  • Rate Limiting
  • Graceful degradation
• Uncensored Model

Sensitive Information Disclosure

• https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
• The model may accidentally reveals proprietary information, intellectual property, or Personally Identifiable Information (PII) that it memorized during training

Improper Output Handling

• https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/
• It refers to insufficient validation, sanitization, and handling of the outputs
• Impacts
  • Web Browsers
    • Cross-Site Scripting (XSS)
    • Cross-Site Request Forgery (CSRF)
  • Backend Systems
    • Server-Side Request Forgery (SSRF)
    • Privilege escalation
    • Remote code execution (RCE)

Unbounded Consumption

• https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/
• It occurs when LLM allows users to conduct excessive and uncontrolled inferences
• Risks
  • Denial of service (DoS)
  • Denial of Wallet (DoW)
  • Model theft

System Prompt Leakage

• https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/
• It refers to the risk that the system prompts or instructions used to steer the behavior of the model can also contain sensitive information that was not intended to be discovered
• https://github.com/asgeirtj/system_prompts_leaks

Prompt-Jailbreaking

• A model whose response has been influenced through a crafted input or context

Guardrails

• https://docs.langchain.com/oss/python/langchain/guardrails
• https://guardrailsai.com/hub
• Implementation
  • Deterministic
    • Strict programmatic rules, regex matches, syntax trees etc.
  • Probabilistic
    • Secondary ML models checking the primary model’s behavior
• Types
  • Input Layer
    • Prompt Injection & Jailbreak Prevention
    • PII/Sensitive Data Masking
  • Orchestrator Layer
    • ensuring it stays on-topic across multiple chat turns
    • Canonical Intent Mapping
    • Protecting the foundational configuration from being overwritten or leaked mid-conversation
  • Output Layer
    • Structural Type Enforcement
    • Content Sanitization & Safety
    • Hallucination & Grounding Checkers

Uncensored Model

• Uncensored model is an informal label for fewer response restrictions, potentially achieved through different training or editing methods
• It can be achieved by
  • Fine tuning
  • Abliteration

Abliteration

• portmanteau of Ablation + Obliteration
  • Ablation is the removal of a component of an AI system
  • In biology it means to surgically remove component of an organism
  • for example: ablative brain surgery
• A post-training technique that reduces an LLM’s refusal behavior
• It achieves it by orthogonalizing its weights against a “refusal direction” found in its activations
• Tools
  • Heretic
• https://en.wikipedia.org/wiki/Ablation_(artificial_intelligence)
• https://webdecoy.com/blog/wtf-are-abliterated-models-uncensored-llms-explained/