Weaknesses That are Specific to AI/ML Technology

Opis

This category identifies weaknesses that are uniquely applicable to AI/ML technology.

Wpisy w tej grupie

• CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
• CWE-1426 Improper Validation of Generative AI Output
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting
• CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters

Uwagi

This category is likely to be updated frequently in future versions. See Research Gaps.

As of CWE 4.20, it is still difficult to distinguish common AI/ML related attacks from the underlying weaknesses. The CWE AI Working Group has had many discussions about this general topic. Much of the latest research has focused on the attacks, and/or characterizing the underlying design and implementation of AI/ML related systems. From a CWE perspective, the distinction between "control" and "data" is not necessarily as deep as currently considered within the AI/ML community, since most weaknesses are characterized in terms of potentially insecure "behavior" - whether that behavior occurred due to design, insecure code, insecure configuration, or data-driven behaviors such as AI/ML. Since AI/ML is frequently derived from repositories of software that consume AI/ML components - many public reports of AI/ML vulnerabilities ultimately result from commonly-occurring weaknesses that appear in most kinds of software. There are several weakness-focused research efforts within the industry, but these efforts are still in the early stages.

Źródła