Traditional security operates on a fundamental assumption: you can inspect what you’re protecting. You can audit firewall rules, trace code execution, inspect network packets. When something goes wrong, you can step through the logic and find the flaw.
AI systems break this assumption entirely.
The Inspection Problem
A neural network doesn’t have logic you can step through in the traditional sense. When a model makes a prediction, that decision emerges from millions of weighted parameters learned during training. You can’t read it like code. You can’t trace the execution path like you would with a conditional statement.
This creates a fundamental challenge for security practitioners: how do you secure something you can’t fully inspect?
New Attack Surfaces
The attack surface for AI systems is radically different from traditional software:
-
Training data poisoning — An attacker doesn’t need to modify your code. They need to influence your training data. If your model learns from poisoned data, the vulnerability is baked into the model itself.
-
Adversarial inputs — Small, carefully crafted perturbations to input data can cause models to misclassify with high confidence. A stop sign with a few stickers becomes invisible to an autonomous vehicle.
-
Prompt injection — When your attack surface is natural language, traditional input validation falls apart. How do you sanitize an attack vector that’s literally designed to communicate intent?
What Traditional Security Teaches Us
This isn’t to say traditional security principles don’t apply. They do—but they require translation:
-
Defense in depth still matters, but the layers are different. Training pipeline security, model versioning, inference monitoring.
-
Least privilege still applies, but now includes model access controls and training data governance.
-
Monitoring and detection becomes even more critical when you can’t predict behavior from reading code.
Where I’m Focused
My current research applies machine learning to detect anomalies in DevSecOps pipelines—essentially using ML to secure ML. The same techniques that detect anomalous pipeline behavior can detect anomalous model behavior.
This is practical, engineering-focused work. Not theoretical alignment research, but the real problems organizations face deploying AI systems today:
- Securing ML pipelines end-to-end
- Detecting when models are being manipulated
- Responding rapidly when new AI vulnerabilities emerge
The problems don’t have mature solutions yet. That’s exactly where I want to be.
This is the first in what I hope becomes a series on AI security. I’m documenting my learning journey from DevSecOps into this emerging field. If you’re working on similar problems, I’d love to connect.