# Google SAIF explained: 15 risks, 24 controls and how to test them

Source: https://airedteamingservices.com/guides/google-saif/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

Google SAIF explained for testers: its 15 risks and 24 controls, a mapping to OWASP LLM 2026 and MITRE ATLAS, and which risks a black-box test can show.

> **Short answer:** Google's Secure AI Framework (SAIF) is a set of AI security guidance on saif.google. On 9 November 2026 the site listed 15 risks and 24 controls, a risk map, and a risk self-assessment. It is not a certification. A black-box test can show about a third of the risks, such as prompt injection, insecure output and rogue actions. The rest need design review.

Google SAIF, the Secure AI Framework, is Google's guidance for securing AI systems, published on saif.google. It gives a risk map, a list of risks, a list of controls and a risk self-assessment. This page explains what the site lists, maps its risks to OWASP and MITRE ATLAS IDs, and says which risks a tester can show from outside. Counts below come from the live pages on 9 November 2026.

## What is Google SAIF?

SAIF is a framework from Google for building and using AI securely. The site's sections are Components, Risks, Controls, an AI Development Primer, a Risk Self Assessment, a Focus on Agents section, an Agent Risk Self Assessment, Why SAIF and Resources ([saif.google](https://saif.google/secure-ai-framework)).

The SAIF map splits AI work in two. The upper half covers deployment and user queries and is aimed at "Model Consumers". The lower half covers model development and is aimed at "Model Creators". The map groups components in four areas: Data, Infrastructure, Model and Application. Agents get a separate diagram.

The site says the map and the risk assessment were contributed to the Coalition for Secure AI (CoSAI). It also says its content is "not a reflection of Google's current technical implementations". It gives no version number or date, so cite it with your check date.

## What are the SAIF elements and risks?

The risks page listed 15 risks on 9 November 2026 and says who can mitigate each one ([SAIF Risks](https://saif.google/secure-ai-framework/risks)).

| Who mitigates | Risks |
|---|---|
| Model creators (4) | Data Poisoning, Unauthorized Training Data, Model Source Tampering, Excessive Data Handling |
| Model consumers (5) | Denial of ML Service, Model Reverse Engineering, Insecure Integrated Component, Insecure Model Output, Rogue Actions |
| Both (6) | Model Exfiltration, Model Deployment Tampering, Prompt Injection, Model Evasion, Sensitive Data Disclosure, Inferred Sensitive Data |

The controls page listed 24 controls in six groups ([SAIF Controls](https://saif.google/secure-ai-framework/controls)): Data (4), Infrastructure (4), Model (3), Application (5), Assurance (4) and Governance (4). Two of the Assurance controls are named Red Teaming and Vulnerability Management. Model controls include Input Validation and Sanitization, Output Validation and Sanitization, and Adversarial Training and Testing. Application controls include Agent Permissions and Agent Observability, which the page tags as new.

The risks page says Assurance and Governance controls "should be applied to all risks, by all parties, across the AI development lifecycle".

## How does SAIF map to OWASP LLM 2026?

The two lists have different shapes. SAIF covers training data and the model supply chain. The OWASP Top 10 for LLM Applications 2026, published August 4, 2026, ranks 10 risks of LLM applications. The mapping below is our reading of the names and one-line meanings. Neither source publishes it.

| SAIF risk | Closest OWASP LLM 2026 entry |
|---|---|
| Data Poisoning | LLM05:2026 Data and Model Poisoning |
| Model Source Tampering, Model Deployment Tampering | LLM04:2026 Supply Chain |
| Insecure Integrated Component | LLM04:2026 Supply Chain |
| Denial of ML Service | LLM06:2026 Unbounded Consumption |
| Model Reverse Engineering, Model Exfiltration | LLM06:2026 Unbounded Consumption (model cloning) |
| Prompt Injection | LLM01:2026 Prompt Injection |
| Sensitive Data Disclosure | LLM02:2026 Sensitive Information Disclosure |
| Insecure Model Output | LLM10:2026 Improper Output Handling |
| Rogue Actions | LLM03:2026 Excessive Agency |
| Unauthorized Training Data, Excessive Data Handling, Model Evasion, Inferred Sensitive Data | No direct entry |

OWASP entries for hidden context (LLM08), misinformation (LLM07) and vector weaknesses (LLM09) have no SAIF risk with the same name. See the [OWASP LLM Top 10 guide](/guides/owasp-top-10-for-llm-applications/) for the full list.

## How does SAIF map to ATLAS?

MITRE ATLAS lists attacker techniques, so a SAIF risk maps to a technique only where the risk describes attacker behavior. We use release v2026.10 ([ATLAS](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.10)).

| SAIF risk | ATLAS technique (v2026.10) |
|---|---|
| Prompt Injection | AML.T0051 LLM Prompt Injection, with .000 Direct and .001 Indirect |
| Data Poisoning | AML.T0020 Training Data Poisoning |
| Rogue Actions | AML.T0053 AI Agent Tool Invocation |
| Insecure Model Output | AML.T0136 Exfiltration via AI User Interface (when output carries data out) |
| Sensitive Data Disclosure | AML.T0086 Exfiltration via AI Agent Tool Invocation, AML.T0024 Exfiltration via AI Inference API |

NIST AI 100-2 E2025 adds attack IDs for several SAIF risks. NISTAML.033 is Membership Inference and NISTAML.035 is Prompt Extraction. Use these when a buyer asks for NIST terms. The [MITRE ATLAS guide](/guides/mitre-atlas/) explains the matrix.

## Which SAIF risks can a test show?

A black-box test sends requests to a live system and records what happens. It can show a risk only when the effect is visible in the system's behavior. Design review is needed for the rest.

| Test type | SAIF risks |
|---|---|
| Black-box test can show | Prompt Injection, Sensitive Data Disclosure, Insecure Model Output, Rogue Actions, Denial of ML Service (bounded) |
| Black-box test can give partial evidence | Insecure Integrated Component, Model Reverse Engineering, Model Exfiltration |
| Needs design or pipeline review | Data Poisoning, Unauthorized Training Data, Model Source Tampering, Model Deployment Tampering, Excessive Data Handling |
| Needs special methods and is rarely in scope | Model Evasion, Inferred Sensitive Data |

Testers can only report what they prove. A clean result for Prompt Injection means the tried attacks failed. It does not mean the risk is gone. The UK NCSC wrote on 8 December 2025 that prompt injection "may never be totally mitigated in the way that SQL injection attacks can be" ([NCSC](https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection)).

## SAIF risk self-assessment: what it is and is not

The Risk Self Assessment is a questionnaire for security practitioners that helps them find which AI risks matter most for them. An Agent Risk Self Assessment was also offered and labeled new on the day we checked. We did not run the questionnaire, and the pages do not describe its scoring.

It is a prioritization aid. It is not a test, an audit or a certificate. A completed assessment tells you which SAIF risks to examine first. It gives no evidence that a control works.

## How to use SAIF in a test scope

Use SAIF at scoping time to check that the scope covers the right risks, then label findings with OWASP and ATLAS IDs.

1. Run the self-assessment and keep the top risks.
2. Mark each risk as "in scope", "design review" or "out of scope" using the table above.
3. Write the in-scope risks into the test plan as test goals, with the system and the accounts to test.
4. Record SAIF risk names in the report next to OWASP and ATLAS IDs.
5. Map fixes to SAIF controls, for example Output Validation and Sanitization for Insecure Model Output.

Our [frameworks page](/frameworks/) shows how findings map to the other references, and the [AI governance framework guide](/guides/ai-governance-framework/) shows where SAIF sits next to NIST and ISO. SAIF is guidance, not a legal requirement and not legal advice.

## Questions

### Is Google SAIF a certification?

No. The saif.google pages we read describe guidance, a risk map, a list of risks and controls, and a self-assessment. They do not describe an audit or a certificate. Do not tell a buyer that you are SAIF certified.

### Is SAIF only for Google Cloud customers?

The pages we read are written for any organization that builds or uses AI. The site says its content is not a reflection of Google's current technical implementations. Check the Google Cloud pages separately if you want product-specific guidance.

### How many risks does SAIF list?

The SAIF risks page listed 15 risks on 9 November 2026, such as Prompt Injection, Rogue Actions and Insecure Model Output. The controls page listed 24 controls. Google can change the lists, so check the live pages before you cite a number.

### Does SAIF replace the OWASP LLM Top 10?

No. SAIF covers the whole lifecycle, including training data and model supply chain. The OWASP Top 10 for LLM Applications ranks 10 application risks. Many teams use SAIF to find gaps and OWASP IDs to label findings.

## Sources

- [SAIF: Google's Guide to Secure AI (saif.google)](https://saif.google/secure-ai-framework)
- [SAIF Risks](https://saif.google/secure-ai-framework/risks)
- [SAIF Controls](https://saif.google/secure-ai-framework/controls)
- [OWASP GenAI LLM Top 10 2026 README](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/README.md)
- [MITRE ATLAS data release v2026.10](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.10)
- [NIST AI 100-2 E2025: Adversarial Machine Learning](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf)