{"id":5051,"date":"2024-08-28T09:00:00","date_gmt":"2024-08-28T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/why-llms-are-just-the-tip-of-the-ai-security-iceberg"},"modified":"2024-08-28T09:00:00","modified_gmt":"2024-08-28T14:00:00","slug":"why-llms-are-just-the-tip-of-the-ai-security-iceberg","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/08\/28\/why-llms-are-just-the-tip-of-the-ai-security-iceberg\/","title":{"rendered":"Why LLMs Are Just the Tip of the AI Security Iceberg"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

COMMENTARY<\/span><\/span><\/p>\n

From the headlines, it’s clear that security risks associated with generative AI (GenAI) and large language models (LLMs) haven’t gone unnoticed. This attention isn’t undeserved \u2014 AI tools do come with real-world risks that range from “hallucinations” to exposing private and proprietary data. Yet it’s vital to recognize that they are part of a much broader attack surface associated with AI and machine learning (ML).<\/span><\/p>\n

The rapid rise of AI has fundamentally changed companies, industries, and sectors. At the same time, it has introduced new business risks that extend from intrusions and breaches to the loss of proprietary data and trade secrets.<\/span><\/p>\n

AI isn’t new \u2014 organizations have been incorporating various forms of the technology into their business models for more than a decade \u2014 but recent mass adoption of AI systems, including GenAI, have changed the stakes. Today’s open software supply chains are incredibly important to innovation and business growth, but this comes with risk. As business-critical systems and workloads increasingly leverage AI, attackers are taking notice and setting their sights, and attacks, on these technologies. <\/span><\/p>\n

Unfortunately, due to the opacity of these systems, most businesses and government agencies cannot identify these highly dispersed and often invisible risks. They don’t have visibility into where the threats exist, or the necessary tools to enforce security policies on the assets and artifacts entering or being used in their infrastructure, and may not have had the opportunity to skill up their teams to manage AI and ML resources effectively. This could set the stage for an AI-related <\/span>SolarWinds<\/a><\/span>– or <\/span>MOVEit-type supply chain security incident<\/a><\/span>. <\/span><\/p>\n

To complicate matters, AI models typically incorporate a vast ecosystem of tools, technologies, open source components, and data sources. Malicious actors can inject vulnerabilities and malicious code into tools and models that reside within the AI development supply chain. With so many tools, pieces of code and other elements floating around, transparency and visibility become increasingly important, yet that visibility remains frustratingly out of reach for most organizations.<\/span><\/p>\n

Looking Under the Surface (of the Iceberg)<\/h2>\n

What can organizations do? Adopt a comprehensive AI security framework, like <\/span>MLSecOps<\/a><\/span>, that delivers visibility, traceability and accountability across AI\/ML ecosystems. This approach supports secure-by-design principles without interfering with regular business operations and performance.<\/span><\/p>\n

Here are five ways to put an AI security program to work and mitigate risks:<\/span><\/p>\n

\n
    \n
  1. \n
    <\/span><\/p>\n
    \n

    Introduce risk management strategies:<\/span><\/span> It’s vital to have clear policies and procedures in place to address security, bias, and fairness across your entire AI development stack. Tooling that supports policy enforcement allows you to efficiently manage risks in regulatory, technical, operational, and reputational domains.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  2. \n
    <\/span><\/p>\n
    \n

    Identify and address vulnerabilities:<\/span><\/span> Advanced security scanning tools can spot AI supply chain vulnerabilities that could cause inadvertent or intentional damage. Integrated security tools can scan your AI bill of materials (AIBOM) and pinpoint potential weaknesses and suggested fixes within tools, models, and code libraries.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  3. \n
    <\/span><\/p>\n
    \n

    Create an AI bill of materials:<\/span><\/span> Just as a traditional software bill of materials catalogs various software components, an AIBOM inventories and tracks all elements used in building AI systems. This includes tools, open source libraries, pre-trained models, and code dependencies. Utilizing the right tools, it’s possible to automate AIBOM generation, establishing a clear snapshot of your AI ecosystem at any given moment.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  4. \n
    <\/span><\/p>\n
    \n

    Embrace open source tools: <\/span><\/span>Free, open source security tools specifically designed for AI and ML can deliver many benefits. These include scanning tools that can detect and protect against potential vulnerabilities in ML models and prompt injection attacks in LLMs.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  5. \n
    <\/span><\/p>\n
    \n

    Encourage collaboration and transparency: <\/span><\/span>AI bug bounty programs offer early insights into new vulnerabilities and provide a mechanism to mitigate them. Over time, this collaborative framework strengthens the overall security posture of the AI ecosystem.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

    LLMs are fundamentally changing business \u2014 and the world. They introduce remarkable opportunities to innovate and reinvent business models. But without a security-first posture, they also present significant risks.<\/span><\/p>\n

    Complex software and AI supply chains don’t have to be invisible icebergs of risk lurking below the surface. With the right processes and tools, organizations can implement an advanced AI security framework that makes hidden risks visible, enabling security teams to track and address them before impact.<\/span><\/p>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    COMMENTARY From the headlines, it’s clear that security risks associated<\/p>\n","protected":false},"author":12,"featured_media":5052,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-5051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=2560%2C1440&ssl=1",2560,1440,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/why-llms-are-just-the-tip-of-the-ai-security-iceberg-scaled.jpg?fit=2560%2C1440&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5051"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/5052"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}