Match each OWASP LLM Top 10 risk to the control that addresses it

Match pairs·Medium·4.0 · 0·~2 min·Asked atForethought Lambda Labs Stripe

Attempt it

Drag each answer to line up with its matching prompt

LLM01 prompt injection

Output schema validation and parameterised calls to downstream systems

LLM02 insecure output handling

Tool allowlist, argument validation, human confirmation on irreversible actions

LLM06 sensitive information disclosure

Input rail with injection classifier plus quarantined processor pattern

LLM08 excessive agency

PII redaction on input and output, prompt cache scrubbing

LLM09 overreliance

Citation required output rails and confidence display in the UI

LLM10 model theft

Rate limiting, query throttling, and watermarking on hosted endpoints

**OWASP LLM Top 10** is the industry checklist of the most consequential security risks in LLM applications. Each risk has a canonical control, a specific defence that targets that specific threat. The match-up: **LLM01 (prompt injection)**, an attacker manipulates input to override the system prompt. Control: input rails with injection classifiers (Llama Prompt Guard, Lakera, Microsoft Prompt Shields) plus the quarantined-processor (dual-LLM) pattern for any flow that mixes external content with tool use. **LLM02 (insecure output handling)**, the model emits content that downstream systems trust as code, SQL, or HTML and execute. Control: schema validation on every output before downstream use, parameterised queries, never concatenate model output into shell commands or SQL. **LLM06 (sensitive information disclosure)**, the model leaks PII, secrets, or proprietary data. Control: PII detection and redaction on input (so it never enters the prompt cache) and on output (so it never reaches the user), plus scrubbing of prompt caches and embedding stores. **LLM08 (excessive agency)**, the agent calls tools it should not call, with arguments it should not pass. Control: tool allowlist, argument validation against a strict schema, human confirmation on irreversible actions (refunds, deletions, money movement). **LLM09 (overreliance)**, users trust the model's output without checking. Control: citation-required output rails (the model must cite sources), confidence display in the UI, and explicit hedging for uncertain answers. **LLM10 (model theft)**, attackers extract model weights or systematically query to recreate model behaviour. Control: rate limiting per source, query throttling, watermarking, and detection of mass-extraction patterns.

**Each OWASP LLM Top 10 risk maps to a specific class of control.** Pairing the right control with the right risk is foundational to building a defence in depth posture rather than a single-classifier deployment. **LLM01 (prompt injection)** is the most cited risk. Direct injection comes via the user message; indirect injection arrives through retrieved content. Defences: **input rails** (Llama Prompt Guard, Lakera Guard) catch obvious patterns at the edge; **retrieval rails** strip instruction-shaped tokens from untrusted documents; **dual-LLM (quarantined processor)** structurally separates the tool-calling model from the model that reads untrusted content. The control set is layered; no single rail is sufficient. **LLM02 (insecure output handling)** is about what happens *after* the model emits. If model output is concatenated into a SQL query, a shell command, an HTML response, or a server-side API call, the model can be tricked into producing payloads that exploit the downstream system. Defences: **output schema validation** (the response must match a strict schema), **parameterised queries**, treating model output as untrusted user input from a security perspective. **LLM06 (sensitive information disclosure)** covers PII, secrets, and proprietary data. Defences: **PII detection and redaction** on input (Presidio, custom regex) so sensitive data never enters the prompt cache; **PII detection on output** so the model cannot leak; **prompt-cache scrubbing** so cached prompts do not retain sensitive data; access controls on retrieval so users only see documents they are authorised for. **LLM08 (excessive agency)** is the agentic-systems risk: the model has tools, the tools have power, and the model can be tricked into using that power. Defences: **tool allowlist** (only enumerated tools are dispatchable), **argument validation** against strict schemas, **human confirmation** on irreversible actions, kill-switch flags for emergency disablement. **LLM09

TL;DR

Six OWASP LLM risks pair with six canonical controls, input rail+dual-LLM for LLM01, output schema validation for LLM02, PII redaction for LLM06, tool gating for LLM08, citations and confidence UI for LLM09, rate

Memory aid

Easy to grasp

Think of a list of common kitchen accidents and the right safety device for each. Cut yourself when chopping? Use a sharp knife and a guard. Burn yourself on a hot pan? Oven mitts. Poison the dish because the chef trusted a spoiled ingredient? Smell and taste check before serving. Eat raw eggs and get sick? Cook properly. Someone steals your secret recipe? Lock the recipe book. Each accident has a matching safety device that targets that specific risk; mixing them up means using oven mitts to prevent food poisoning. The OWASP LLM Top 10 works the same way: ten common threats, each paired with the canonical control that addresses it directly.

Key concepts

Safety & Guardrails

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

The OWASP Top 10 for Large Language Model Applications is the industry-standard threat taxonomy for LLM security. Treating it as a checklist where each item has a canonical control is the basis of any disciplined safety review. The common failure mode is to deploy one classifier, say, an input safety filter, and assume it addresses multiple items. It does not. Each item has its own structural defence at its own layer.

This walkthrough covers the six items in the question, LLM01, LLM02, LLM06, LLM08, LLM09, LLM10, with the canonical control for each, the architectural reason that control is the right answer, and how the controls compose with rail-based frameworks like NeMo Guardrails.

Mental model: the OWASP Top 10 is a threat-model catalogue. The matching controls are the defence in depth playbook. One item, one canonical control; production stacks deploy all of them.

LLM01 prompt injection and LLM02 insecure output handling

LLM01: where the injection comes from

Direct injection arrives in the user message. Indirect injection arrives in retrieved content (documents, webpages, emails, tool outputs). They share a name because the underlying mechanism, adversarial text that hijacks the model's behaviour, is the same, but the attack surface is different.

LLM01 control: layered defence

The canonical control combines two layers:

Input rail (Llama Prompt Guard, Lakera Guard, Microsoft Prompt Shields). Catches the obvious direct-injection patterns at the edge. Cheap, fast, runs on every request.
Retrieval rail (strip instruction tokens from documents, drop unauthorised retrievals) plus dual-LLM / quarantined processor pattern (the tool-calling model never reads untrusted content directly). Closes the indirect-injection gap that filtering alone cannot cover.

A team that deploys only one of these is exposed on the other vector. Both are mandatory for agentic stacks that touch external content.

LLM02: the downstream trust problem

LLM02 is misunderstood as 'unsafe content in the response'. It is not. LLM02 is about what downstream code does with the model's output. If the response is concatenated into a SQL query, executed as shell, parsed as JSON without validation, rendered as raw HTML, or fed into another API as a parameter, the model has become a code-execution channel.

LLM02 control: treat the model as untrusted

The canonical control is to apply the same security hygiene you would to any user-supplied input:

Validate output against a strict schema (Zod, Pydantic, JSON Schema with additionalProperties: false).
Use parameterised queries for any database call constructed from model output.
Escape for the target sink (HTML encode, SQL escape, shell quote).
Never eval model output and never let it directly drive system-level actions without an intermediate validated representation.

This is downstream-code hygiene more than LLM-specific safety. A team that ships an LLM product without this discipline is one prompt-injection away from a full SQL-injection-class incident.

LLM06 sensitive information disclosure and LLM08 excessive agency

LLM09 overreliance and LLM10 model theft

Composition with NeMo's five-rail decomposition and operational priority

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Real products, models, and research that use this idea.

OWASP GenAI Security Project publishes the LLM Top 10 with concrete control recommendations and updates it yearly.
AWS Bedrock Guardrails maps its controls explicitly to OWASP Top 10 categories in its 2026 documentation.

What an interviewer would ask next. Try answering before peeking at the approach.

QHow does the OWASP Top 10 map onto NeMo Guardrails' five rail types?

LLM01 (direct) → input rail; LLM01 (indirect) → retrieval rail; LLM02 → output rail with schema validation plus downstream code hygiene; LLM06 → input and output rails plus prompt-cache isolation; LLM08 → execution rail with allowlist and confirmation; LLM09 → output rail plus product UX. The rail decomposition gives an architectural surface for each item.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Picking a generic control (an input filter) and assuming it addresses multiple OWASP items. Each item has a specific defence; using one control for all collapses the defence in depth model.

60 second bullets to scan on the way to the call.

The six OWASP items in the matching question and their canonical controls
Why LLM01 needs both input rail and dual-LLM

Primary sources. Browse if you want the original framing.