Vulnerability Disclosure and Management for AI/ML Systems: A Working Paper with Policy Recommendations

Artificial intelligence systems, especially those dependent on machine learning (ML), can be vulnerable to intentional attacks that involve evasion, data poisoning, model replication, and exploitation of traditional software flaws to deceive, manipulate, compromise, and render them ineffective. Yet too many organizations adopting AI/ML systems are oblivious to their vulnerabilities. Applying the cybersecurity policies of vulnerability disclosure and management to AI/ML can heighten appreciation of the technologies’ vulnerabilities in real-world contexts and inform strategies to manage cybersecurity risk associated with AI/ML systems. Federal policies and programs to improve cybersecurity should expressly address the unique vulnerabilities of AI-based systems, and policies and structures under development for AI governance should expressly include a cybersecurity component.

 

James X. Dempsey large headshot

James X. Dempsey

Senior Policy Advisor, Geopolitics, Technology, and Governance at the Cyber Policy Center
FULL BIO
Andrew Grotto

Andrew Grotto

Director, Program on Geopolitics, Technology, and Governance
FULL BIO