cyber-security-resources/ai_security/threat-modeling.md

Tools for threat modeling AI systems

There are several tools and methodologies that you can use to conduct threat modeling for AI systems.

Tool / Methodology	Description	Link
Microsoft's STRIDE Model	A model for identifying computer security threats. Useful for categorizing and remembering different types of threats.	Microsoft STRIDE
Microsoft's Threat Modeling Tool	A tool provided by Microsoft to assist in finding threats in the design phase of software projects.	Microsoft Threat Modeling Tool
OWASP's Threat Dragon	An open-source tool from the Open Web Application Security Project. It includes system diagramming and a rule engine to auto-generate threats and countermeasures.	Threat Dragon
PASTA (Process for Attack Simulation and Threat Analysis)	A risk-based threat modeling methodology that provides a systematic approach to threat modeling.	PASTA
MLSec Tools by IBM Research	A suite of tools designed to identify vulnerabilities, conduct robustness checks, and perform attack simulations in machine learning systems.	IBM MLSec Tools
Adversarial Robustness Toolbox by IBM Research	An open-source library dedicated to adversarial attacks and defenses in AI, designed to evaluate the robustness of machine learning models.	Adversarial Robustness Toolbox
AI Fairness 360 by IBM Research	An extensible open-source toolkit that can help you examine, report, and mitigate discrimination and bias in machine learning models throughout the AI application lifecycle.	AI Fairness 360
Google's What-If Tool	An interactive visual interface designed to help you understand the datasets and models.	Google What-If Tool

Additional Information

Threat modeling and risk assessment is the process of identifying potential threats and risks in a system and assessing their potential impact. In the context of AI systems, this process involves understanding how the AI system could be attacked, misused, or otherwise compromised, and evaluating the potential consequences.

Here are a few examples:

1. Data Poisoning Threat: In a data poisoning attack, an adversary might manipulate the training data to make the AI system learn incorrect patterns or behaviors. For instance, if an AI is used for a recommendation system, an attacker might try to poison the data to make the system recommend their product more frequently. The risk associated with this threat might be reputational damage, loss of user trust, and financial loss due to incorrect recommendations.

2. Model Inversion Threat: An attacker might attempt a model inversion attack, where they use the AI system's predictions to infer sensitive details about the training data. For example, if the AI system is a model trained to predict disease based on genetic data, an attacker could use the model to infer the genetic data of the patients used in the training set. The risk here is the potential violation of user privacy and potential legal repercussions.

3. Adversarial Attack Threat: Adversarial attacks involve manipulating the input to an AI system to cause it to make a mistake. For instance, an adversarial attack might involve slightly altering an image so that an image recognition AI system misclassifies it. The risk in this case could be the incorrect operation of the AI system, leading to potential negative consequences depending on the system's use case.

4. Model Theft Threat: An attacker might attempt to steal the AI model by using the model's API to create a copy of it. The risk here is intellectual property theft, as well as any potential misuse of the stolen model.

Risk assessment involves evaluating the likelihood and potential impact of these threats. For instance, data poisoning might be considered a high-risk threat if the AI system is trained on public data and used for critical decision-making. On the other hand, a model inversion attack might be considered a lower-risk threat if the model does not handle sensitive data or if strong privacy-preserving measures are in place. The results of this risk assessment will guide the security measures and precautions implemented in the next stages of the AI system's development lifecycle.