Intro to LLM Security – OWASP Top 10 for Large Language Models (LLMs)

Understanding LLM Security Risks

Large Language Models have become integral to modern applications, powering conversational interfaces, content generation, and intelligent automation systems. However, as these models gain prominence, they introduce new security vulnerabilities that developers and security teams must understand and address. The OWASP Top 10 for Large Language Models provides a comprehensive framework for identifying and mitigating the most critical security risks associated with LLM applications. This workshop, guided by WhyLabs CEO Alessya Visnjic, brings practical knowledge on how to assess and defend LLM applications against real-world adversarial scenarios.

The OWASP LLM Top 10 Framework

The OWASP Top 10 for Large Language Models (version 1.1) establishes ten critical vulnerability categories that every developer building with LLMs should understand. These vulnerabilities span from input-level attacks like prompt injection to output handling flaws, training data integrity issues, resource exhaustion, supply chain risks, information disclosure, plugin design weaknesses, excessive model autonomy, over-reliance on model outputs, and model theft. Each category represents a distinct attack vector that can compromise application security, user privacy, or system availability. Understanding this framework enables development teams to adopt a security-first mindset when designing and deploying LLM applications at scale.

Prompt Injection and Input Manipulation

Prompt injection emerges as one of the most immediate threats to LLM applications. This attack vector allows adversaries to manipulate model behavior by injecting malicious instructions into user inputs, potentially bypassing intended constraints or causing the model to perform unintended actions. The workshop covers detection and prevention techniques using LangKit, a specialized toolkit for monitoring and securing language model outputs. Developers learn how to sanitize inputs, implement input validation layers, and detect when a model is behaving outside expected parameters, all critical steps in building resilient LLM systems.

Data Poisoning and Training Integrity

Training data poisoning represents a sophisticated threat where attackers corrupt the data used to train or fine-tune models, injecting biases, backdoors, or malicious patterns. This vulnerability is particularly dangerous because poisoned models may function normally in most scenarios while exhibiting compromised behavior in specific conditions. The workshop explores how to verify training data quality, implement data governance practices, and use monitoring tools to detect anomalous model behavior that might indicate successful poisoning. Organizations must establish robust data pipelines and verification procedures to maintain model integrity throughout the training lifecycle.

Denial of Service and Resource Protection

Model Denial of Service attacks exploit computational limitations by overwhelming LLM systems with resource-intensive requests, causing service degradation or crashes. Attackers might submit extremely long inputs, trigger expensive computations, or exploit model inefficiencies to exhaust available resources. Supply chain vulnerabilities add another layer of risk, as dependencies on third-party models, APIs, and libraries can introduce unexpected security gaps. The workshop addresses rate limiting, resource quotas, input length validation, and comprehensive dependency management as essential protective measures for maintaining application availability and security.

Output Handling and Information Disclosure

Insecure output handling occurs when applications fail to properly validate, sanitize, or manage model-generated content before presenting it to users. Models may inadvertently leak sensitive information from training data, generate content containing personally identifiable information, or produce outputs that could be exploited in downstream systems. The workshop demonstrates how to implement output filtering, redaction techniques, and monitoring systems that flag potentially problematic outputs. Sensitive information disclosure vulnerabilities require multi-layered protection combining model-level controls, application-level filtering, and comprehensive logging and auditing mechanisms.

Plugin Design and Excessive Agency

LLM applications often integrate with external tools and plugins to extend functionality—accessing databases, APIs, email systems, or file storage. Insecure plugin design allows models to make unintended calls to external systems or execute harmful operations with excessive agency. Related risks emerge when models are granted too much autonomy or users over-rely on model outputs without appropriate human oversight. The workshop covers permission models, execution sandboxing, and audit logging for plugin interactions. Organizations must implement strict boundaries on model actions, require human approval for sensitive operations, and maintain comprehensive records of all external system interactions triggered by LLM applications.

Building Resilient LLM Applications

Model theft represents the final critical vulnerability in the OWASP framework, encompassing both extraction of proprietary model weights and intellectual property theft through API attacks. Protecting against model theft requires access controls, rate limiting on API endpoints, and monitoring for suspicious query patterns that might indicate extraction attempts. The workshop equips participants with practical tools like LangKit and WhyLabs monitoring platform to observe model behavior continuously, detect anomalies, and respond to security incidents. By implementing these comprehensive security practices—from input validation through output monitoring and external integration protection—development teams create resilient LLM applications that maintain security, reliability, and trustworthiness throughout their operational lifetime.