Idea Security Verification Framework
View on GitHub →isvf is an open framework for defining, testing, and auditing inference boundaries in LLM-enabled systems: addressing semantic leakage, cross-domain inference, and the reachability risks that traditional security tools do not measure.
Open draft, licensed CC BY 4.0. Community review and contributions are welcome. See CONTRIBUTING.md for guidelines.
Read our intro post: Idea Security Standards Concept Draft →The Core Idea
Traditional security asks:
Who can access which file?
isvf asks an additional question:
What conclusions can this system derive once prompts, retrieved documents, tools, memory, and outputs are combined into one inferential workflow?
Organizations are no longer only trying to prevent direct disclosure of secrets. They must also govern what conclusions AI systems can derive, what domains those systems may combine, and what sensitive meanings can become reachable through retrieval, memory, tools, prompts, and synthesis.
- Semantic Leakage
- Disclosure of protected meaning through paraphrase, translation, summarization, abstraction, or inference, even when the original secret text is not exposed.
- Cross-Domain Inference
- Production of a prohibited conclusion by combining fragments from multiple domains that are individually permitted but jointly sensitive.
- Reachability
- The set of conclusions an AI system can reliably produce under defined operating conditions.
- Unreachable Statement Classes (USCs)
- Categories of conclusions that policy requires the system not to make reachable.
- Domain Join Matrix
- A structured record of which information domain combinations are allowed, prohibited, or approval-gated.
- Evidence Packs
- Audit-ready artifacts showing that idea boundaries are defined, enforced, tested, and monitored.
Proposed Metrics
isvf introduces draft verification metrics for community refinement. These are provisional: contributions that refine definitions, testing protocols, and scoring methods are especially welcome.
- Domain Inference Risk DIR
- How often a system derives an out-of-domain conclusion using only in-domain inputs under defined boundary conditions. Measures the probability of cross-domain inference leakage.
- Leakage Event Rate LER
- How often protected information or protected meaning appears in outputs, weighted by materiality. Captures both direct disclosure and semantic paraphrase events.
- Crawl-Resilience Score CRS
- How well a system resists repeated or multi-session extraction attempts over time. Measures durability of idea boundaries against iterative adversarial probing.
Relationship to Existing Frameworks
isvf is not intended to replace OWASP, NIST, MITRE ATLAS, or other AI security efforts. It is a contribution layer that strengthens existing frameworks with inference-boundary modeling.
-
OWASP
LLM Top 10 crosswalk available in the repository
-
NIST AI RMF
Maps isvf controls to Govern, Map, Measure, and Manage functions
-
MITRE ATLAS
Extends adversarial ML tactics with inference-boundary attack patterns
-
ISO / SOC 2
Evidence pack templates align to audit and compliance requirements
Repository Structure
isvf/
idea-security-verification-framework.md
glossary/
glossary.md
controls/
control-catalog.md
metrics/
domain-inference-risk.md
leakage-event-rate.md
crawl-resilience-score.md
crosswalks/
owasp.md · nist-ai-rmf.md · mitre-atlas.md
examples/
domain-inventory-template.md
join-matrix-template.md
unreachable-statement-classes-template.md
evidence-pack-template.mdHow to Contribute
Useful contributions include:
- • Clarity edits and new glossary terms
- • Proposed controls and test cases
- • Sector-specific implementation examples
- • Regulatory crosswalks (ISO, SOC 2, CMMC, etc.)
- • Metric refinements and red-team scenarios
- • Critiques of weak or unrealistic assumptions
Open an issue before submitting a pull request. See CONTRIBUTING.md for full guidelines.
Related Work from SenTeGuard
View the Framework
isvf is an early public draft on GitHub. Review the framework, open issues, and contribute to the idea security standard.