deardaniel/secdata-raw huggingface dataset:
OWASP LLM Top 10: ASVS

# OWASP Top 10 for LLMs Mapped to ASVS

This document outlines how the [OWASP Top 10 for Large Language Model Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/#) can be addressed through the [Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/) by OWASP. While ASVS is tailored towards web applications, its principles can guide the security of web services and applications utilizing LLMs.

## ASVS Requirements and LLM Vulnerabilities

Each LLM vulnerability is mapped to relevant ASVS requirements that can help mitigate associated risks:

### LLM01: Prompt Injection

- **V5: Validation, Sanitization, and Encoding**
  - Apply strict input validation and sanitization to prevent malicious or unexpected input from affecting LLM outputs.

### LLM02: Insecure Output Handling

- **V5: Validation, Sanitization, and Encoding**
  - Ensure all outputs are encoded and handled securely to prevent injection attacks or information disclosure.

### LLM03: Training Data Poisoning

- **V7: Cryptography**
  - Secure the integrity of training data through encryption and integrity checks to mitigate risks of data poisoning.

### LLM04: Model Denial of Service

- **V11: Business Logic Verification**
  - Implement controls to prevent abuse of LLM features that could lead to denial of service, such as rate limiting and resource management.

### LLM05: Supply-Chain Vulnerabilities

- **V12: File and Resources Verification**
  - Verify the security of third-party libraries and dependencies to address supply-chain vulnerabilities.

### LLM06: Sensitive Information Disclosure

- **V9: Data Protection**
  - Protect sensitive data processed by LLMs through encryption, access controls, and data leakage prevention techniques.

### LLM07: Insecure Plugin Design

- **V14: Configuration Verification**
  - Ensure plugins or extensions for LLMs are securely designed and do not introduce vulnerabilities.

### LLM08: Excessive Agency

- **V13: API and Web Service Verification**
  - Design APIs interacting with LLMs to limit excessive agency and ensure secure communication.

### LLM09: Overreliance

- **V1: Architecture, Design, and Threat Modeling**
  - Conduct threat modeling to identify and mitigate risks associated with overreliance on LLM technologies.

### LLM10: Model Theft

- **V9: Data Protection**
  - Implement measures to protect LLM models as sensitive intellectual property, including access control and encryption.

**Note:** The ASVS mapping provides a framework for addressing LLM vulnerabilities within web applications and services. It is important to tailor the implementation of these ASVS requirements to the specific context and architecture of applications utilizing LLM technologies.
Adversarial Robustness Toolbox: requirements test

--find-links https://download.pytorch.org/whl/cpu

# base

numpy==1.26.4
scipy==1.12.0
matplotlib==3.10.3
scikit-learn==1.7.2
six==1.17.0
Pillow==12.0.0
tqdm==4.67.1
statsmodels==0.14.5
pydub==0.25.1
resampy==0.4.3
ffmpeg-python==0.2.0
cma==4.4.0
pandas==2.3.2
librosa==0.11.0
numba~=0.62.1
opencv-python
sortedcontainers==2.4.0
h5py==3.14.0
multiprocess>=0.70.12

# frameworks

tensorflow==2.20.0
keras==3.11.3

# PyTorch
torch==2.8.0
torchaudio==2.8.0
torchvision==0.23.0

# PyTorch image transformers
timm==1.0.19

# YOLO dependencies
ultralytics==8.3.213

catboost==1.2.8
GPy==1.13.2
lightgbm==4.6.0
xgboost==3.0.5

kornia~=0.8.1
tensorboardX==2.6.4
lief==0.16.6
jax[cpu]==0.4.30

# tests and style checking
pytest~=8.4.2
pytest-mock~=3.15.1
pytest-cov~=7.0.0
pylint==4.0.1
mypy==1.17.1
pycodestyle==2.14.0
black==25.9.0
ruff==0.13.0
types-six==1.17.0.20250515
types-PyYAML==6.0.12.20250915
types-setuptools==80.9.0.20250822

# other
requests~=2.32.5

# ART
-e .

# NOTE to contributors: When changing/adding packages, please make sure that the packages are consistent with those
# present within the Dockerfile
Adversarial Robustness Toolbox: SECURITY

# Security Policy

## Reporting a Vulnerability
(Following https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md)

Please email reports about any security related issues you find to info@lfai.foundation. This mail is delivered to a small team maintaining the Trusted-AI projects. Your email will be acknowledged within a few business day, and you'll receive a more detailed response to your email within 7 days indicating the next steps in handling your report.

Please use a descriptive subject line for your report email. After the initial reply to your report, the team will endeavor to keep you informed of the progress being made towards a fix and announcement.

In addition, please include the following information along with your report:

Your name and affiliation (if any).
A description of the technical details of the vulnerabilities. It is very important to let us know how we can reproduce your findings.
An explanation who can exploit this vulnerability, and what they gain when doing so -- write an attack scenario. This will help us evaluate your report quickly, especially if the issue is complex.
Whether this vulnerability public or known to third parties. If it is, please provide details.
If you believe that an existing (public) issue is security-related, please send an email to info@lfai.foundation. The email should include the issue ID and a short description of why it should be handled according to this security policy.

We apply the following disclosure process:

When a report is received, we confirm the issue and determine its severity.
If we know of specific third-party services or software based on ART that require mitigation before publication, those projects will be notified.
An advisory is prepared (but not published) which details the problem and steps for mitigation.
The vulnerability is fixed and potential workarounds are identified.
Wherever possible, the fix is also prepared for the branches corresponding to all releases of ART at most one year old. We will attempt to commit these fixes as soon as possible, and as close together as possible.

Patch releases are published for all fixed released versions and the advisory is published.

Note that each version of ART is supported for only 1 year after the release.
Adversarial Robustness Toolbox: README

# Adversarial Robustness Toolbox examples

## Get Started with ART
These examples train a small model on the MNIST dataset and creates adversarial examples using the Fast Gradient Sign 
Method. Here we use the ART classifier to train the model, it would also be possible to provide a pretrained model to 
the ART classifier. The parameters are chosen for reduced computational requirements of the script and not optimised 
for accuracy.


### TensorFlow
[get_started_tensorflow_v2.py](get_started_tensorflow_v2.py) demonstrates a simple example of using ART with TensorFlow v2.x. 

### Keras
[get_started_keras.py](get_started_keras.py) demonstrates a simple example of using ART with Keras.

### PyTorch
[get_started_pytorch.py](get_started_pytorch.py) demonstrates a simple example of using ART with PyTorch.

### Scikit-learn
[get_started_scikit_learn.py](get_started_scikit_learn.py) demonstrates a simple example of using ART with Scikit-learn. 
This example uses the support vector machine SVC, but any other classifier of Scikit-learn can be used as well.

### XGBoost
[get_started_xgboost.py](get_started_xgboost.py) demonstrates a simple example of using ART with XGBoost.
Because gradient boosted tree classifier do not provide gradients, the adversarial examples are created with the 
black-box method Zeroth Order Optimization.

### InverseGAN
[get_started_inverse_gan.py](get_started_inverse_gan.py) demonstrates a simple example of using 
InverseGAN and Defense ART with TensorFlow v1.x.

### LightGBM
[get_started_lightgbm.py](get_started_lightgbm.py) demonstrates a simple example of using ART with LightGBM.
Because gradient boosted tree classifier do not provide gradients, the adversarial examples are created with the 
black-box method Zeroth Order Optimization.


## Applications

[adversarial_training_cifar10.py](adversarial_training_cifar10.py) trains a convolutional neural network on the CIFAR-10 
dataset, then generates adversarial images using the DeepFool attack and retrains the network on the training set 
augmented with the adversarial images.

[adversarial_training_data_augmentation.py](adversarial_training_data_augmentation.py) shows how to use ART and Keras 
to perform adversarial training using data generators for CIFAR-10.

[mnist_cnn_fgsm.py](mnist_cnn_fgsm.py) trains a convolutional neural network on MNIST, then crafts FGSM attack examples 
on it.

[mnist_poison_detection.py](mnist_poison_detection.py) generates a backdoor for MNIST dataset, then trains a 
convolutional neural network on the poisoned dataset and runs activation defence to find poison.
Adversarial Robustness Toolbox: setup

Setup
=====

Information on installing the Adversarial Robustness Toolbox can be found on `GitHub`_.

.. _GitHub: https://github.com/Trusted-AI/adversarial-robustness-toolbox/wiki/Get-Started#setup
Adversarial Robustness Toolbox: notebooks

Notebooks
=========

Jupyter notebooks with detailed case studies using ART can be found in directory `notebooks` on `GitHub`_.


.. _GitHub: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/README.md
Adversarial Robustness Toolbox: examples

Examples
========

Get Started examples of ART can be found in directory `examples` on `GitHub`_.


.. _GitHub: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/examples/README.md
Adversarial Robustness Toolbox: utils

:mod:`art.utils`
================
.. automodule:: art.utils

Deprecation Operations
----------------------
.. autofunction:: deprecated
.. autofunction:: deprecated_keyword_arg

Math Operations
---------------
.. autofunction:: projection
.. autofunction:: random_sphere
.. autofunction:: original_to_tanh
.. autofunction:: tanh_to_original

Label Operations
----------------
.. autofunction:: to_categorical
.. autofunction:: float_to_categorical
.. autofunction:: check_and_transform_label_format
.. autofunction:: random_targets
.. autofunction:: least_likely_class
.. autofunction:: second_most_likely_class
.. autofunction:: get_label_conf
.. autofunction:: get_labels_np_array
.. autofunction:: compute_success_array
.. autofunction:: compute_success
.. autofunction:: compute_accuracy

Dataset Operations
------------------
.. autofunction:: load_dataset
.. autofunction:: get_file
.. autofunction:: make_directory
.. autofunction:: clip_and_round
.. autofunction:: preprocess
.. autofunction:: segment_by_class
.. autofunction:: performance_diff
.. autofunction:: is_probability
Adversarial Robustness Toolbox: attacks

:mod:`art.attacks`
==================
.. automodule:: art.attacks

Base Class Attacks
------------------
.. autoclass:: Attack
   :members:

Base Class Evasion Attacks
--------------------------
.. autoclass:: EvasionAttack
   :members:

Base Class Poisoning Attacks
----------------------------
.. autoclass:: PoisoningAttack
.. autoclass:: PoisoningAttackBlackBox
.. autoclass:: PoisoningAttackWhiteBox
.. autoclass:: PoisoningAttackTransformer
   :members:

Base Class Extraction Attacks
-----------------------------
.. autoclass:: ExtractionAttack
   :members:

Base Class Inference Attacks
----------------------------
.. autoclass:: InferenceAttack
.. autoclass:: AttributeInferenceAttack
   :members:

Base Class Reconstruction Attacks
---------------------------------
.. autoclass:: ReconstructionAttack
   :members:
Adversarial Robustness Toolbox: metrics

:mod:`art.metrics`
==================
.. automodule:: art.metrics

Clique Method Robustness Verification
-------------------------------------
.. autoclass:: RobustnessVerificationTreeModelsCliqueMethod
   :members:
   :special-members:

Loss Sensitivity
----------------
.. autofunction:: loss_sensitivity

Empirical Robustness
--------------------
.. autofunction:: empirical_robustness

CLEVER
------
.. autofunction:: clever_u
.. autofunction:: clever_t

Wasserstein Distance
--------------------
.. autofunction:: wasserstein_distance

Pointwise Differential Training Privacy
---------------------------------------
.. autofunction:: PDTP

SHAPr Membership Privacy Risk
-----------------------------
.. autofunction:: SHAPr
Adversarial Robustness Toolbox: summary writer

:mod:`art.summary_writer`
=========================
.. automodule:: art.summary_writer

Base Class SummaryWriter
------------------------
.. autoclass:: SummaryWriter
   :members:

Summary Writer Default
-------------------------
.. autoclass:: SummaryWriterDefault
   :members:
   :special-members:
Adversarial Robustness Toolbox: data generators

:mod:`art.data_generators`
==========================
.. automodule:: art.data_generators

Base Class
----------
.. autoclass:: DataGenerator
   :members:


Framework-Specific Data Generators
----------------------------------
.. autoclass:: KerasDataGenerator
   :members:

.. autoclass:: NumpyDataGenerator
   :members:

.. autoclass:: PyTorchDataGenerator
   :members:

.. autoclass:: TensorFlowV2DataGenerator
   :members:
Adversarial Robustness Toolbox: estimators

:mod:`art.estimators`
=====================
.. automodule:: art.estimators

Base Class Estimator
--------------------
.. autoclass:: BaseEstimator
   :members:

Mixin Base Class Loss Gradients
-------------------------------
.. autoclass:: LossGradientsMixin
   :members:

Mixin Base Class Neural Networks
--------------------------------
.. autoclass:: NeuralNetworkMixin
   :members:

Mixin Base Class Decision Trees
-------------------------------
.. autoclass:: DecisionTreeMixin
   :members:

Base Class KerasEstimator
-------------------------
.. autoclass:: KerasEstimator
   :members:
   :special-members: __init__
   :inherited-members:

Base Class PyTorchEstimator
---------------------------
.. autoclass:: PyTorchEstimator
   :members:
   :special-members: __init__
   :inherited-members:

Base Class ScikitlearnEstimator
-------------------------------
.. autoclass:: ScikitlearnEstimator
   :members:
   :special-members: __init__
   :inherited-members:

Base Class TensorFlowV2Estimator
--------------------------------
.. autoclass:: TensorFlowV2Estimator
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: extraction

:mod:`art.attacks.extraction`
=============================
.. automodule:: art.attacks.extraction

Copycat CNN
-----------
.. autoclass:: CopycatCNN
   :members:
   :special-members:

Functionally Equivalent Extraction
----------------------------------
.. autoclass:: FunctionallyEquivalentExtraction
   :members:
   :special-members:

Knockoff Nets
-------------
.. autoclass:: KnockoffNets
   :members:
   :special-members:
Adversarial Robustness Toolbox: poisoning

:mod:`art.attacks.poisoning`
============================
.. automodule:: art.attacks.poisoning

Backdoor Attack DGM ReD
-----------------------
.. autoclass:: BackdoorAttackDGMReDTensorFlowV2
   :members:
   :special-members:

Backdoor Attack DGM Trail
-------------------------
.. autoclass:: BackdoorAttackDGMTrailTensorFlowV2
   :members:
   :special-members:

Adversarial Embedding Attack
----------------------------
.. autoclass:: PoisoningAttackAdversarialEmbedding
   :members:
   :special-members:

Backdoor Poisoning Attack
-------------------------
.. autoclass:: PoisoningAttackBackdoor
   :members:
   :special-members:

Hidden Trigger Backdoor Attack
------------------------------
.. autoclass:: HiddenTriggerBackdoor
   :members:
   :special-members:

Bullseye Polytope Attack
------------------------
.. autoclass:: BullseyePolytopeAttackPyTorch
   :members:
   :special-members:

Clean Label Backdoor Attack
---------------------------
.. autoclass:: PoisoningAttackCleanLabelBackdoor
   :members:
   :special-members:

Feature Collision Attack
------------------------
.. autoclass:: FeatureCollisionAttack
   :members:
   :special-members:

Gradient Matching Attack
------------------------
.. autoclass:: GradientMatchingAttack
   :members:
   :special-members:

Poisoning SVM Attack
--------------------
.. autoclass:: PoisoningAttackSVM
   :members:
   :special-members:

Sleeper Agent Attack
--------------------
.. autoclass:: SleeperAgentAttack
   :members:
   :special-members:
Adversarial Robustness Toolbox: model inversion

:mod:`art.attacks.inference.model_inversion`
============================================
.. automodule:: art.attacks.inference.model_inversion

Model Inversion MIFace
----------------------
.. autoclass:: MIFace
   :members:
   :special-members:
Adversarial Robustness Toolbox: reconstruction

:mod:`art.attacks.inference.reconstruction`
===========================================
.. automodule:: art.attacks.inference.reconstruction

Database Reconstruction
-----------------------
.. autoclass:: DatabaseReconstruction
   :members:
   :special-members:
Adversarial Robustness Toolbox: attribute inference

:mod:`art.attacks.inference.attribute_inference`
================================================
.. automodule:: art.attacks.inference.attribute_inference

Attribute Inference Baseline
----------------------------
.. autoclass:: AttributeInferenceBaseline
   :members:
   :special-members:

Attribute Inference Black-Box
-----------------------------
.. autoclass:: AttributeInferenceBlackBox
   :members:
   :special-members:

Attribute Inference Membership
------------------------------
.. autoclass:: AttributeInferenceMembership
   :members:
   :special-members:

Attribute Inference Base Line True Label
----------------------------------------
.. autoclass:: AttributeInferenceBaselineTrueLabel
   :members:
   :special-members:

Attribute Inference White-Box Lifestyle Decision-Tree
-----------------------------------------------------
.. autoclass:: AttributeInferenceWhiteBoxLifestyleDecisionTree
   :members:
   :special-members:

Attribute Inference White-Box Decision-Tree
-------------------------------------------
.. autoclass:: AttributeInferenceWhiteBoxDecisionTree
   :members:
   :special-members:
Adversarial Robustness Toolbox: membership inference

:mod:`art.attacks.inference.membership_inference`
=================================================
.. automodule:: art.attacks.inference.membership_inference

Membership Inference Black-Box
------------------------------
.. autoclass:: MembershipInferenceBlackBox
   :members:
   :special-members:

Membership Inference Black-Box Rule-Based
-----------------------------------------
.. autoclass:: MembershipInferenceBlackBoxRuleBased
   :members:
   :special-members:

Membership Inference Label-Only - Decision Boundary
---------------------------------------------------
.. autoclass:: LabelOnlyDecisionBoundary
   :members:
   :special-members:

Membership Inference Label-Only - Gap Attack
--------------------------------------------
.. autoclass:: LabelOnlyGapAttack
   :members:
   :special-members:

Shadow Models
-------------
.. autoclass:: ShadowModels
   :members:
   :special-members:
Adversarial Robustness Toolbox: estimators

:mod:`art.experimental.estimators`
==================================
.. automodule:: art.experimental.estimators

Base Class JaxEstimator
-----------------------
.. autoclass:: JaxEstimator
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: classification

:mod:`art.experimental.estimators.classification`
=================================================
.. automodule:: art.experimental.estimators.classification

JAX Classifier
--------------
.. autoclass:: JaxClassifier
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: object detection

:mod:`art.estimators.object_detection`
======================================
.. automodule:: art.estimators.object_detection

Mixin Base Class Object Detector
--------------------------------
.. autoclass:: ObjectDetectorMixin
   :members:
   :special-members: __init__
   :inherited-members:

Object Detector PyTorch
-----------------------
.. autoclass:: PyTorchObjectDetector
   :members:
   :special-members: __init__
   :inherited-members:

Object Detector PyTorch Faster-RCNN
-----------------------------------
.. autoclass:: PyTorchFasterRCNN
   :members:
   :special-members: __init__
   :inherited-members:

Object Detector PyTorch YOLO
----------------------------
.. autoclass:: PyTorchYolo
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: gan

:mod:`art.estimators.gan`
=========================
.. automodule:: art.estimators.gan

TensorFlowV2 GAN
----------------
.. autoclass:: TensorFlowV2GAN
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: poison mitigation

:mod:`art.estimators.poison_mitigation`
=======================================
.. automodule:: art.estimators.poison_mitigation

Keras Neural Cleanse Classifier
-------------------------------
.. autoclass:: KerasNeuralCleanse
   :members:
   :special-members: __init__
   :inherited-members:

Mixin Base Class STRIP
----------------------
.. autoclass:: STRIPMixin
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: regression scikitlearn

:mod:`art.estimators.regression.scikitlearn`
============================================
.. automodule:: art.estimators.regression.scikitlearn

Base Class Scikit-learn
-----------------------
.. autoclass:: ScikitlearnRegressor
   :members:

Scikit-learn Decision Tree Regressor
------------------------------------
.. autoclass:: ScikitlearnDecisionTreeRegressor
   :members:
   :special-members: __init__
   :inherited-members:
Adversarial Robustness Toolbox: object tracking

:mod:`art.estimators.object_tracking`
======================================
.. automodule:: art.estimators.object_tracking

Mixin Base Class Object Tracker
-------------------------------
.. autoclass:: ObjectTrackerMixin
   :members:
   :special-members: __init__
   :inherited-members:

Object Tracker PyTorch GOTURN
-----------------------------
.. autoclass:: PyTorchGoturn
   :members:
   :special-members: __init__
   :inherited-members: