Principle:OWASP Www project top 10 for large language model applications Vulnerability Testing
| Knowledge Sources | Domains | Last Updated |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM Security, Adversarial Testing, Vulnerability Assessment | 2026-02-14 |
Overview
Adversarial testing of LLM applications using documented vulnerability patterns from the OWASP Top 10 as test case templates.
Description
Vulnerability Testing is a security assessment principle that transforms the "Common Examples of Risk" sections from OWASP LLM Top 10 vulnerability entries into actionable test case templates for adversarial testing. Each vulnerability entry documents specific risk patterns categorized by type (e.g., LLM01 defines Direct Prompt Injections and Indirect Prompt Injections; LLM06 defines Excessive Functionality, Excessive Permissions, and Excessive Autonomy; LLM10 defines Variable-Length Input Flood, Denial of Wallet, Continuous Input Overflow, Resource-Intensive Queries, Model Extraction via API, Functional Model Replication, and Side-Channel Attacks). These documented examples serve as a structured corpus of vulnerability patterns that can be systematically converted into test cases. This principle addresses the problem of ad-hoc security testing by grounding test case design in the authoritative OWASP vulnerability taxonomy, ensuring coverage across all ten vulnerability categories.
Usage
Use Vulnerability Testing when:
- Designing adversarial test suites for LLM application security assessments
- Converting documented vulnerability patterns into executable test cases
- Validating that an LLM application is resistant to known vulnerability types
- Conducting penetration testing with structured test case coverage
- Building regression test suites for LLM security controls
Theoretical Basis
The methodology proceeds through three stages:
Stage 1: Common Example Extraction
Each vulnerability entry contains a "Common Examples of Risk" (or equivalent) section with numbered examples. These examples describe concrete vulnerability patterns:
- LLM01 (Prompt Injection): Two types -- Direct Prompt Injections (user input directly alters model behavior) and Indirect Prompt Injections (model accepts input from external sources like websites or files). Impact includes disclosure of sensitive information, unauthorized access to functions, executing arbitrary commands, and manipulating critical decisions.
- LLM06 (Excessive Agency): Six examples across three categories -- Excessive Functionality (examples 1-3: unnecessary extension functions, residual development plugins, open-ended shell command extensions), Excessive Permissions (examples 4-5: over-privileged database connections, generic high-privileged identities), and Excessive Autonomy (example 6: deletions without user confirmation).
- LLM10 (Unbounded Consumption): Seven examples -- Variable-Length Input Flood, Denial of Wallet (DoW), Continuous Input Overflow, Resource-Intensive Queries, Model Extraction via API, Functional Model Replication, and Side-Channel Attacks.
Stage 2: Test Case Template Generation
Each extracted common example is transformed into a test case template:
FOR each vulnerability_entry IN LLM01..LLM10:
examples = extract_common_examples(vulnerability_entry)
FOR each example IN examples:
test_case = TestCaseTemplate(
vulnerability_id = vulnerability_entry.id,
example_id = example.number,
category = example.category,
description = example.description,
test_objective = derive_objective(example),
expected_behavior = derive_expected_behavior(example)
)
test_suite.add(test_case)
Stage 3: Test Execution and Result Collection
Test cases are executed against the target LLM application. Results are recorded as pass/fail with evidence, forming the input to subsequent risk scoring and mitigation gap analysis.
The structured nature of the OWASP common examples (numbered, categorized, with consistent formatting) makes them particularly suitable for systematic test case derivation, ensuring that testing coverage maps directly to the authoritative vulnerability taxonomy.