Project Glasswing: Securing Critical Software for the AI Era

Project Glasswing secures AI software by tackling novel vulnerabilities and supply chain risks. This Action Pack guides you through integrating robust security practices across the entire AI development lifecycle, from threat modeling to continuous monitoring.

intermediate30 min5 steps

The play

Conduct AI-Specific Threat Modeling
Perform threat modeling for your AI models and data pipelines. Identify unique AI attack vectors like model poisoning, adversarial attacks, data exfiltration, and inference attacks.
Implement Secure Data Handling
Apply strict access controls, encryption (at rest and in transit), and anonymization/pseudonymization to sensitive AI training and inference data. Validate all incoming data rigorously to prevent malicious injections.
Secure AI Model Development
Rigorously validate all model inputs to prevent adversarial examples. Harden models using techniques like adversarial training or differential privacy. Regularly scan and update all third-party libraries and open-source components for vulnerabilities.
Secure AI Deployment & Monitoring
Secure container images (e.g., Docker, Kubernetes) used for model deployment by scanning for vulnerabilities and enforcing least privilege. Protect model inference APIs with authentication, authorization, rate limiting, and input validation. Implement continuous monitoring for model drift, data drift, and potential adversarial attacks in production.
Integrate Automated Security Tools
Automate scanning of project dependencies for known vulnerabilities (e.g., using `pip-audit`). Apply Static Application Security Testing (SAST) tools to your AI codebases, including model definition files and data processing scripts.

Starter code

# Install pip-audit
pip install pip-audit

# Generate a requirements file for your project
pip freeze > requirements.txt

# Scan your project's Python dependencies for known vulnerabilities
pip-audit -r requirements.txt