V.8 Monitoring and Anomaly Detection
Control Objective
Continuously monitor the use of LLM-powered applications to detect anomalous behavior or outputs that could indicate security incidents or system misuse.
# | Requirement | L1 | L2 | L3 |
---|---|---|---|---|
8.1 | Continuously monitor the usage patterns of LLM applications for anomalies that could indicate security incidents, such as unexpected spikes in usage or deviations from typical output patterns. | ✓ | ✓ | |
8.2 | Establish logging and alerting mechanisms for events that could suggest prompt leaks, such as the appearance of canary tokens (see 5.7) in logs or unexpected language patterns. | ✓ | ✓ |
Last updated