Threat modelling AI applications
Data flows, trust boundaries and tools of an AI application are mapped to identify where untrusted inputs could manipulate the model or where data could leak.
GCRI · Artificial Intelligence and Autonomous Systems
Cybersecurity for AI systems
Cybersecurity and cryptography protect AI systems and the data they use. In this field the focus is threats specific to AI, such as prompt injection, poisoning and model theft, alongside conventional security of the software and infrastructure around models.
01Register
Cybersecurity for AI systems on the record.
Method recordSTEM method
- MethodCybersecurity and cryptography
- Applied inArtificial Intelligence and Autonomous Systems
- Data3 inputs
- Checks3 validation steps
- Canonical pageSTEM Commons
02Application
What cybersecurity and cryptography does here.
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. In artificial intelligence and data and compute, cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance. The canonical description is on the STEM Commons.
Model supply chain integrity
Provenance of datasets and model weights is recorded and verified with signatures and hashes before use.
Injection defence testing
Applications are tested with suites of injection attempts, and the success rate is tracked as defences change.
03Monitor
Security assessment.
The screen a team would use to follow this method: its measures, states and decisions. Names are examples and values are illustrative.
Security assessment
AI and autonomous systems · Cybersecurity for AI systems · Run R-5953
Two high findingsGCRI · Artificial Intelligence and Autonomous Systems
Findings
| Weak key rotation | Identity service | High | PR.AA | Open |
| Unpatched gateway | Edge | High | PR.PS | Fixing |
| Logging gap | Payments API | Medium | DE.CM | Open |
| Stale accounts | Directory | Low | PR.AA | Closed |
Method card
- Method
- Cybersecurity and cryptography
- Framework
- CSF 2.0 functions
- Scope
- 54 assets
- Label
- MODELLED
Control coverage by function
04Data
What the method consumes.
Datasets and records used by cybersecurity and cryptography on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| MITRE ATLAS techniques | Threat catalogue | REPORTED |
| Vulnerability databases | Known flaws | REPORTED |
| Security test results | Defence performance | OBSERVED |
05Simulator
A cascade through interdependent networks.
A hazard footprint takes out co-located assets in every layer; fragmentation, dependency between layers and overload of the survivors then spread the failure. The 3D view separates the layers by depth. Teaching model with stated illustrative values, not a prediction.
Controls
- Assets per layer
- 18
- Hazard footprint
- 8% of area
- Assets that depend on another layer
- 60%
- Spare capacity (tolerance)
- 30%
Readouts
- Assets hit by the hazard
- 2%
- Assets still working
- 72%
- Amplification of the initial damage
- 15.0 times
- Steps to settle
- 3
Numbers, methods and sources
| Step | Data centres working (%) | Networks working (%) | Power working (%) |
|---|---|---|---|
| 0 | 94 | 100 | 100 |
| 1 | 89 | 67 | 100 |
| 2 | 72 | 67 | 100 |
| 3 | 72 | 67 | 78 |
Methods
- Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
- Overload cascades Motter and Lai (2002), Physical Review E 66
- Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
- Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
- Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page’s map can draw:
- Major roads Natural Earth
- Railways Natural Earth
- Seaports Natural Earth
- Airports Natural Earth
- Urban extents Natural Earth
- Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
- Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Artificial Intelligence and Autonomous Systems in Foundry
- Tested at Artificial Intelligence and Autonomous Systems in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Artificial Intelligence and Autonomous Systems in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
06Validation
How results are checked.
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
| Check | How it is done |
|---|---|
| Threat model review | Threat models are reviewed when the application or its tools change |
| Provenance verification | Model artefacts are checked against signed records |
| Regression testing | Security tests are rerun after each update |
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
07Methods and evidence
How Cybersecurity for AI systems is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Model, equations and assumptions
The model structure used for Cybersecurity for AI systems, the assumptions it makes and how each is tested.
Risk of element i
Ri = f(Hi, Ei, Vi, Ci)hazard, exposure, vulnerability and coping capacityExpected annual loss
EAL = ∑k pk · Lkover events k with annual probability pkCoupled systems
xt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| Assumption | Why it is made | How it is tested |
|---|---|---|
| Hazard and exposure are independent within an event | Keeps the loss integral tractable | Compare with a copula fit on joint records |
| Couplings are linear near the operating point | Lets shocks propagate through A | Perturb beyond the linear range and compare |
| Vulnerability curves transfer between places | Local curves are rarely available | Validate against observed losses where they exist |
- Inputs
- versioned datasets with provenance
- Outputs
- distributions, never single numbers
- Code
- released with the model card and tests
- Reproduction
- same data, code, environment and seed
FAIR guiding principles · GO FAIR and FORCE11W3C PROV · World Wide Web ConsortiumGuidance on consistent treatment of uncertainties · IPCCCEOS Analysis Ready Data · Committee on Earth Observation Satellites
08Connections
Topics that rely on this method.
09Stewardship
Who maintains the method.
Cybersecurity and Digital Resilience stewards cybersecurity and cryptography for the Consortium and reviews how it is applied across platforms.
10Connected
Where this page leads across the Consortium.
11Questions
Questions and answers.
What are the limits of cybersecurity and cryptography in this field?
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
How are results checked?
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method’s use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRIArtificial Intelligence and Autonomous SystemsExponential TechnologyLabs Evidence
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Artificial Intelligence and Autonomous Systems
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.