Securing Generative AI: Is it all an Illusion?
summary
A team at Salesforce describes threat modeling performed in early 2023 and a practical mitigation set: they implement RAG over a vector DB, require zero data retention and zero training, deploy encryption at every node, and validate outputs with human review. They test webapp integrations and plugins for prompt injection, use guard tools like Nemo Guardrails and LM-GUARD, isolate code execution with containers (e.g., firecracker), and verify vendor settings via admin dashboards.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker welcome
- 1:24Generative AI rapid adoption timeline
- 3:14Security challenges of fast AI adoption
- 5:00Threat modeling primer and setup
- 9:20Interactive threat modeling exercise
- 12:49Key threats in LLM vendor systems
- 17:05Key risk considerations for AI systems
- 21:19Technical controls to mitigate risks
- 28:10Authorization and data flow controls
- 30:15Testing AI-enabled applications
- 33:04Leveraging AI for security projects
- 34:27Lessons learned and best practices
- 36:57Q&A session
related talks
44mGenerative AI Security — A Practical Guide to Securing Your AI Application
09mSecuring Generative AI Workloads
27mSafeguarding Generative AI Applications: Navigating Security Challenges and Best Pract...
27mHarnessing Generative AI: Security strategies for next-gen applications
44mThreat Modeling to Protect Your Generative AI Applications
39mSecuring AI at Scale: Practical Defenses against Prompt...
46mGenerative AI: Cyber resiliency and risk
34mInvisible Infiltration of AI Supply Chains: Protective Measures from Adversari...