Artificial Intelligence and Autonomous Systems
The Global Centre for Risk and Innovation (GCRI)
AI and cybersecurity meet in three ways: AI systems can be attacked, AI can help attackers, and AI can help defenders. Models can be poisoned, stolen, manipulated or made to leak data; their supply chains of data, weights and libraries carry new risks. This page sets out how these threats work, how AI systems are secured, and what evidence serves the security teams and regulators responsible.
GCRI · In development · service level R0
AI security is the protection of AI systems against attack and of organizations against AI-enabled threats. Models can be poisoned, manipulated, stolen or made to leak data, their supply chains of data and weights carry risk, and AI can both lower the cost of some attacks and help defenders.
For ai cyber security, in GCRI's spatial-intelligence reading, the map opens on night lights, population density and true-colour imagery with true colour from NASA GIBS, framed on East Asia; 3 further NASA layers wait in the list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For ai cyber security, in GCRI's spatial-intelligence reading, the map opens on night lights, population density and true-colour imagery with true colour from NASA GIBS, framed on East Asia; 3 further NASA layers wait in the list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Adversarial methods and model exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Adversarial inputs, prompt injection, data extraction and model theft target the model itself. Classic application vulnerabilities still apply around it.
Training data, pretrained weights, libraries and plugins come from many sources. Poisoned data or tampered models can introduce hidden behaviour.
Generative AI can draft phishing, translate lures and help write code, lowering the skill barrier for some attacks. The size of this effect is studied and debated.
Machine learning detects anomalies, triages alerts and finds vulnerabilities. Defenders must also secure the AI tools they adopt.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Adversarial example | An input deliberately altered to cause a model to make a mistake. |
| Data poisoning | Manipulating training data to implant hidden behaviour or degrade a model. |
| Model extraction | Reconstructing a model's behaviour or parameters by sending it many queries and studying the answers. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Vulnerabilities reported in AI frameworks and libraries | count of CVE entries | monthly | Vulnerability databases | REPORTED |
| Adversarial robustness | accuracy under a stated attack | per evaluation | Robustness testing | OBSERVED |
| Models with signed provenance | percent of deployed models | per inventory | Model registries | DECLARED |
| AI-related security incidents | count by technique | annual | Incident reports | REPORTED |
| Time to detect AI system compromise | hours | per incident | Incident response records | OBSERVED |
| Organizations with AI security policies | percent of surveyed organizations | per survey | Industry surveys | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| MITRE ATLAS | Adversarial tactics and techniques against AI systems, with case studies | Public, licence to check |
| NIST adversarial machine learning taxonomy | Terminology and taxonomy of attacks and mitigations | Public domain, US government |
| National Vulnerability Database and CVE records | Vulnerabilities in AI software | Public domain, US government |
| ENISA reports on AI cybersecurity | Threat landscape and good practice for securing AI | Public, ENISA terms |
| Joint guidance from national cyber agencies on secure AI system development | Secure design, development, deployment and operation | Public, terms per agency |
Artificial Intelligence and Autonomous Systems prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Chief information security officers | How to secure AI systems the organization builds or buys | Threat models; supply chain checklists |
| National cybersecurity agencies | What guidance to issue on AI security | Incident and vulnerability evidence |
| Developers | Which defences to build into models and applications | Robustness testing; attack taxonomies |
Adversarial examples are inputs altered in ways imperceptible to people that cause models to err. Data poisoning inserts malicious examples into training data to plant backdoors. Membership inference and extraction attacks recover information about training data or replicate a model through repeated queries. For language models, jailbreaks and prompt injection bypass intended restrictions.
On the other side, AI can help attackers find vulnerabilities, write malware variants and craft convincing phishing at scale, and help defenders triage alerts, analyse code and detect anomalies. The balance between the two is an open research question.
Structured attempts to break a system, combining cybersecurity and cryptography and artificial intelligence and machine learning expertise. Red-teaming finds problems but cannot prove their absence.
Mapping assets, adversaries and attack paths across data, training, deployment and supply chain.
Measuring performance under adversarial perturbation. Robustness to known attacks does not imply robustness to new ones.
Provenance of datasets, models and dependencies, with signing and verification. Provenance tooling is still maturing.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.