SECAI Core · phase 7 of 15 · noun
Input validation
Any technique used to ensure that the data entered into a field or variable in an application is handled appropriately by that application.
The Explain card
- Plain English
- Input validation is any technique that ensures data entering a field or variable is handled appropriately by the application: checked for type, length, format and content before it is trusted.
- Example
- An AI assistant accepts uploaded documents for summarisation. Validation enforces file type and size, rejects embedded scripts, and strips hidden text before the content reaches the model, closing a common prompt injection route.
- Why it matters
- Validation is the oldest control in application security and it still applies to AI: prompts, files and retrieved content are all input. Validating early reduces what an attacker can smuggle into the model.
- Hook
- Input validation: never trust input, and a prompt is input.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
Before a user message is concatenated with the system prompt, the chat API runs input validation on length, encoding, and allowed characters.
Why these words
- input English in + put, from Old English putian, to thrust names the arriving stream, so the check is attached to what comes in rather than to what comes out
- validation Medieval Latin validatio, a making valid, from Latin validus, strong supplies the head noun, the confirming act the arriving data must pass
Where it came from
- Origin
- English computing collocation from English in + put (Old English putian, to thrust) and Medieval Latin validatio (a making valid, from Latin validus, strong)
- Entered the language
- 1960s
- What changed
- Input had meant a contribution of money or labour, then the data fed into a machine. Validation had meant making a document legally strong, then confirming that a claim holds. Programming shops of the 1960s joined the pair for the check a record must pass before a program will process it, and AI security later applied the same pair to prompts, files, and retrieved content.
How it is spelled
- Pattern
- English in- before p stays in, unlike Latin in- which becomes im- as in import
- Pattern
- -ate verbs take -ation for the noun of the act
- Pattern
- val- from Latin valere keeps v and a single l
- Breaks the pattern
- the noun phrase stays two words; a hyphen appears only when the pair modifies another noun
- Breaks the pattern
- input keeps n before p because it is English in + put, not a Latin compound
Spelled like
- output
- confirmation
- valid
- formation
Broken into chunks
-
in
- inner
- inside
- insert
-
put
- output
- throughput
- putting
-
val
- valid
- valor
- evaluate
-
ation
- confirmation
- formation
- evaluation
What it sits beside
Same subject
Same shape
- input quota
- input manipulation
- model validation
- cross-validation
Input compounds
- input quota
- input manipulation
- input sanitization
Validation family
- model validation
- data validation
- cross-validation
Runtime fences
Where it sits in the deck
Phase 7: AI-Specific Runtime Controls: Guardrails, Limits, and Enforcement
Responsible AI principles must be enforced mechanically — learn the runtime controls that constrain model inputs, outputs, and resource consumption.
