Threat Modeling for AI Apps with Attacks as Code
summary
Describes encoding MITRE ATLAS and OWASP LLM risks as repeatable experiments so teams can run Secops-Chaos against third‑party models and Kubernetes stacks, with concrete demos against OpenAI GPT‑4o that detect data poisoning in uploaded training prompts, confirm data leakage from model outputs, and show a malicious pickle model spawning privileged containers and reading node info. Provides experiments‑as‑code, verifiers for PII detection, and an open source framework teams can run in CI/CD to continuously validate runtime AI behavior.
AI-written summary · about
chapters (10)
- 0:00AI threat modeling intro
- 1:05Missing pieces in AI threat modeling
- 4:32Chaos engineering for AI security
- 6:35Microservices vs LLM risks
- 10:10Embracing chaos for secure AI
- 11:59PsychOps Chaos tool
- 14:47Demo: PII in prompts
- 19:00Demo: Data leakage tests
- 21:51Demo: Securing third-party models
- 24:27Conclusion & Q&A
related talks
45mThreat Modeling in the Age of AI
29mSecurity-Focused Chaos Engineering - the Lasso for AI Security T...
18mCommit Secure AI: Embedding Security in Code, Pipelines, and Production
41mThreat Modelling for ML/AI systems
33mSecuring Agentic AI With PyTorch: Threat Modeling & LLM Red Teaming in Practice
28mAI Under the Hood: Unmasking Hidden Threats
29mThreat Modeling Meets Model Training: Web App Security Skills...
58mSTOIC Security: Shielding Your Generative AI App from the Five Deadly Risks