Skip to content

Add C11.3.5: constrain caller-supplied sampling and decoding parameters - #1121

Merged
jmanico merged 3 commits into
OWASP:mainfrom
ImanSharaf:patch-1
Sep 5, 2026
Merged

Add C11.3.5: constrain caller-supplied sampling and decoding parameters#1121
jmanico merged 3 commits into
OWASP:mainfrom
ImanSharaf:patch-1

Conversation

@ImanSharaf

Copy link
Copy Markdown
Contributor

Closes #1116. Adds the control agreed with @ottosulin and @RicoKomenda in the issue.

11.3.5 (L2) Verify that inference endpoints constrain sampling and decoding parameters supplied by untrusted callers (e.g., temperature, top-k, top-p, logit bias, candidate/n count) to server-side approved ranges and defaults, rejecting out-of-policy values.

Three files: the C11.3 table, the matching AD.16 row in Appendix B, and logit added to the cspell dictionary.

@RicoKomenda

Copy link
Copy Markdown
Collaborator

@jmanico please have a look :)

@jmanico
jmanico merged commit d1c90d6 into OWASP:main Sep 5, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add security controls for caller-supplied generation parameters

3 participants