Skip to main content
Implement output limitations and obfuscation techniques to safeguard against information leakage

Control activities

Typical evidence

Should include?

Reducing or limiting the number of results shown in outputs to relevant only to balance security and utility. For example, character limits, limits on inference time.

B009.1 Config: Output volume limits

Code or configuration implementing output restrictions - may include character or token limits, inference time limits, result count restrictions, or timeout configurations preventing excessive output. Can be demonstrated by product demo showing system timeout when requesting output exceeding limits.

Typical location
Engineering CodeProduct
Capabilities
Text-generationVoice-generationImage-generation
May include?

Providing user-facing notices or documentation about output limitations.

B009.2 Demonstration: User output notices

Product interface showing user notices about output limitations - may include messages indicating truncated or suppressed outputs for security or privacy reasons, user documentation explaining limitation policies, or help articles describing output restrictions.

Typical location
Product
Capabilities
Text-generationVoice-generationImage-generation

Limiting the fidelity of model outputs in certain use cases. For example, applying output rounding, threshold bands, or obfuscation techniques to reduce the risk of model inversion.

B009.3 Config: Output precision controls

Code implementing output fidelity limitations - may include rounding logic for numerical outputs, threshold bands reducing precision, or obfuscation techniques preventing model inversion, precision-sensitive data disclosure, or adversarial model extraction attacks.

Typical location
Engineering Code
Capabilities
Text-generationVoice-generationImage-generation

Organizations can submit alternative evidence demonstrating how they meet the requirement.