How do you implement AI model security against adversarial attacks?
AI model security protects against attacks that manipulate model inputs, training data, or model behavior. Attack types: (1) Adversarial examples: carefully crafted inputs that cause misclassification (adding imperceptible noise to an image causes a stop sign to be classified as a speed limit sign). Defense: adversarial training (include adversarial examples in training data), input preprocessing (detect and clean adversarial perturbations), and certified defenses (provably robust to perturbations within a bound). (2) Data poisoning: corrupted training data causes the model to learn incorrect patterns. Defense: training data validation, anomaly detection on training data, robust training algorithms, and data provenance tracking. (3) Model extraction: attackers query the model to replicate its behavior. Defense: rate limiting API access, adding noise to model outputs, watermarking model predictions, and monitoring for extraction patterns. (4) Prompt injection: for LLMs, adversarial inputs that override system instructions. Defense: separate system and user content, implement input sanitization, output validation, and instruction hierarchy. (5) Membership inference: attackers determine if specific data was in the training set. Defense: differential privacy during training, regularization, and output perturbation. Implementation: implement input validation (detect out-of-distribution inputs, check for adversarial patterns), output validation (verify predictions are within expected ranges), model monitoring (detect drift in prediction distributions that may indicate attack), and access control (rate limiting, authentication, usage quotas). Red teaming: regularly test models with adversarial inputs, engage external security researchers, participate in bug bounty programs, and maintain a vulnerability disclosure process. Incident response: detect attacks through monitoring, contain (disable affected endpoints), investigate (analyze attack vectors), remediate (patch model or infrastructure), and document for future prevention.