Weaknesses Related to AI/ML Products

Opis

CWE entries in this view (graph) are unique to AI/ML products, or are commonly encountered in products that use or support AI/ML.

Wpisy w tej grupie

• CWE-1446 Weaknesses That are Specific to AI/ML Technology
• CWE-1447 General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology

Uwagi

This view is likely to be updated frequently in future versions. See Research Gaps.

As of CWE 4.20, it is still difficult to distinguish common AI/ML related attacks from the underlying weaknesses. The CWE AI Working Group has had many discussions about this general topic. Much of the latest research has focused on the attacks, and/or characterizing the underlying design and implementation of AI/ML related systems. From a CWE perspective, the distinction between "control" and "data" is not necessarily as deep as currently considered within the AI/ML community, since most weaknesses are characterized in terms of potentially insecure "behavior" - whether that behavior occurred due to design, insecure code, insecure configuration, or data-driven behaviors such as AI/ML. Since AI/ML is frequently derived from repositories of software that consume AI/ML components - many public reports of AI/ML vulnerabilities ultimately result from commonly-occurring weaknesses that appear in most kinds of software. There are several weakness-focused research efforts within the industry, but these efforts are still in the early stages.

Źródła