AID-H-002: AI-Contextualized Data Sanitization & Input Validation
Implement rigorous validation, sanitization, and filtering mechanisms for all data fed into AI systems.
Training & Fine-Tuning Data: This applies to training data, fine-tuning data, and live operational inputs (including user prompts for LLMs). The goal is to detect and remove or neutralize malicious content, anomalous data, out-of-distribution samples, or inputs structured to exploit vulnerabilities like prompt injection or data poisoning before they can adversely affect the model or downstream systems.
LLM-Specific Controls: For LLMs, this involves specific techniques like stripping or encoding control tokens and filtering for known injection patterns or harmful content.
Multimodal Systems: For multimodal systems, this includes validating and sanitizing inputs across all modalities (e.g., text, image, audio, video) and ensuring that inputs in one modality cannot be readily used to trigger vulnerabilities, bypass controls, or inject malicious content into another modality processing pathway.
Training & Fine-Tuning Data: This applies to training data, fine-tuning data, and live operational inputs (including user prompts for LLMs). The goal is to detect and remove or neutralize malicious content, anomalous data, out-of-distribution samples, or inputs structured to exploit vulnerabilities like prompt injection or data poisoning before they can adversely affect the model or downstream systems.
LLM-Specific Controls: For LLMs, this involves specific techniques like stripping or encoding control tokens and filtering for known injection patterns or harmful content.
Multimodal Systems: For multimodal systems, this includes validating and sanitizing inputs across all modalities (e.g., text, image, audio, video) and ensuring that inputs in one modality cannot be readily used to trigger vulnerabilities, bypass controls, or inject malicious content into another modality processing pathway.
Scope boundary
Owns preventive validation, sanitization, normalization, quarantine, and admission controls for data and inputs before they affect training, inference, multimodal processing, or downstream AI workflows. Each child is separated by lifecycle stage, data representation, and observation point.
Sub-techniques
- AID-H-002.001: Training, Fine-Tuning & Evaluation Data Sanitization
- AID-H-002.002: Inference-Time Prompt & Input Validation
- AID-H-002.003: Multimodal Input Sanitization
- AID-H-002.004: Feature Pipeline Integrity & Transformation Audit
- AID-H-002.005: Label Provenance, Integrity & Tamper Detection
- AID-H-002.006: Dataset Split Integrity, Partition Governance & Leakage Prevention
- AID-H-002.007: External Media & Document Provenance Verification
- AID-H-002.008: Realtime Multimodal Input Stream Security
- AID-H-002.009: Untrusted ML Dataset Artifact Parser Admission
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.002 AI Supply Chain Compromise: Data
- AML.T0011 User Execution
- AML.T0011.000 User Execution: Unsafe AI Artifacts
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0015 Evade AI Model
- AML.T0020 Training Data Poisoning
- AML.T0025 Exfiltration via Cyber Means
- AML.T0037 Data from Local System
- AML.T0043 Craft Adversarial Data
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0051.002 LLM Prompt Injection: Triggered
- AML.T0052.001 Phishing: Deepfake-Assisted Phishing
- AML.T0054 LLM Jailbreak
- AML.T0057 LLM Data Leakage
- AML.T0059 Erode Dataset Integrity
- AML.T0065 LLM Prompt Crafting
- AML.T0068 LLM Prompt Obfuscation
- AML.T0071 False RAG Entry Injection
- AML.T0093 Prompt Infiltration via Public-Facing Application
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0112 Machine Compromise
- AML.T0112.001 Machine Compromise: AI Artifacts
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.000 Publish Poisoned AI Artifacts: Datasets
- AML.T0119 Exploit Automated Artifact Processing Pipeline
- AML.T0123 Obfuscated Files or Information
- AML.T0129 Triggers in Multimodal Inputs
- AML.T0130 AI Agent Response Biasing
- AML.T0131 Crafted AI Assistant Links
- AML.T0134 AI Targeted Cloaking
MAESTRO
- Adversarial Examples (L1)
- Data Poisoning (Training Phase) (L1)
- Reprogramming Attacks (L1)
- Data Poisoning (L2)
- Data Tampering (L2)
- Compromised RAG Pipelines (L2)
- Input Validation Attacks (L3)
- Framework Evasion (L3)
- Manipulation of Evaluation Metrics (L5)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM04:2026 Supply Chain
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
- LLM07:2026 Misinformation
OWASP ML Top 10 2023
- ML01:2023 Input Manipulation Attack
- ML02:2023 Data Poisoning Attack
- ML04:2023 Membership Inference Attack
- ML06:2023 AI Supply Chain Attacks
- ML08:2023 Model Skewing
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
NIST Adversarial Machine Learning 2025
- NISTAML.012 Clean-label Poisoning
- NISTAML.013 Data Poisoning
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.022 Evasion
- NISTAML.023 Backdoor Poisoning
- NISTAML.024 Targeted Poisoning
- NISTAML.033 Membership Inference
- NISTAML.037 Training Data Attacks
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-1.3 Multimodal Injection and Manipulation
- AITech-2.3 Reward Hacking
- AITech-6.1 Training Data Poisoning
- AITech-7.3 Data Source Abuse and Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-9.1 Model or Agentic System Manipulation
- AITech-13.1 Disruption of Availability
- AITech-14.1 Unauthorized Access
- AITech-15.1 Harmful Content
- AITech-19.2 Fusion Payload Split
- AISubtech-1.1.1 Instruction Manipulation
- AISubtech-1.1.2 Obfuscation
- AISubtech-1.1.4 Token Exploitation
- AISubtech-1.3.1 Image-Text Injection
- AISubtech-1.3.2 Image Manipulation
- AISubtech-1.3.3 Audio Command Injection
- AISubtech-1.3.4 Video Overlay Manipulation
- AISubtech-2.3.2 Verifier Manipulation
- AISubtech-2.3.3 Shortcut Acquisition
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-6.1.2 Reinforcement Biasing
- AISubtech-6.1.3 Reinforcement Signal Corruption
- AISubtech-7.3.1 Corrupted Third-Party Data
- AISubtech-8.2.1 Training Data Exposure
- AISubtech-8.2.2 LLM Data Leakage
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-10.1.3 Sensitive Data Reconstruction
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-19.2.1 Convergence Payload Injection
Google Secure AI Framework 2.0 - Risks
- DP: Data Poisoning
- EDH: Excessive Data Handling
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- MEV: Model Evasion
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Raw Data 1.3: Poor data quality
- Raw Data 1.6: Insufficient data lineage
- Raw Data 1.7: Lack of data trustworthiness
- Raw Data 1.8: Legality of data
- Raw Data 1.11: Compromised 3rd-party datasets
- Data Prep 2.1: Preprocessing integrity
- Data Prep 2.2: Feature manipulation
- Data Prep 2.3: Raw data criteria
- Data Prep 2.4: Adversarial partitions
- Datasets 3.1: Data poisoning
- Datasets 3.3: Label flipping
- Algorithms 5.1: Lack of tracking and reproducibility of experiments
- Evaluation 6.1: Evaluation data poisoning
- Evaluation 6.2: Insufficient evaluation data
- Model Serving - Inference requests 9.1: Prompt inject
- Model Serving - Inference requests 9.3: Model breakout
- Model Serving - Inference requests 9.9: Input Resource Control
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Platform 12.7: Initial Access
- Agents - Core 13.6: Intent Breaking & Goal Manipulation