这包括利用默认安全的基础架构防护功能，以及过去二十年中积累的专业知识来保护 AI 系统、应用和用户。同时，培养组织专业知识，以与 AI 技术的发展保持一致，并开始在 AI 和不断变化的威胁模型的情况下扩缩和调整基础架构保护措施。例如，SQL 注入等注入技术已经存在一段时间，组织可以调整缓解措施（例如输入排错和限制）来帮助更好地防范即时注入式攻击。
2. 扩大检测和响应范围，将 AI 技术融入组织的威胁宇宙
及时性对于检测和响应 AI 相关的网络突发事件至关重要，并将威胁情报和其他功能扩展到组织可以提高两者。对于组织，这包括监控生成式 AI 系统的输入和输出以检测异常情况，并使用威胁情报来预测攻击。这项工作通常需要与信任和安全团队、威胁情报和反滥用团队协作。
跨控制框架的一致性可支持 AI 风险缓解和跨不同平台和工具的规模保护，以确保以可扩展且具有成本效益的方式为所有 AI 应用提供最佳保护。在 Google，这包括将默认的安全保护扩展到 Vertex AI 和 Security AI Workbench 等 AI 平台，并将控制和保护措施内置到软件开发生命周期中。涉及通用用例的功能（如 Perspective API）可以帮助整个组织受益于先进的保护功能。
5. 调整控件以调整缓解措施，并为 AI 部署创建更快的反馈循环
通过持续学习持续测试实现，可以确保检测和保护功能可以应对不断变化的威胁环境。这包括基于突发事件和用户反馈的强化学习等技术，包括更新训练数据集、微调模型以从战略上应对攻击，以及允许构建模型以进一步在上下文中嵌入安全性（例如检测异常行为）等步骤。组织还可以定期开展红色团队培训，以提高 AI 产品和产品的安全保障。
6. 将 AI 系统风险置于周围的业务流程中
最后，与组织将如何部署 AI 相关的端到端风险评估有助于做出明智决策。这包括评估端到端业务风险，例如针对特定类型的应用的数据沿袭、验证和运营行为监控。此外，组织还应构建自动检查来验证 AI 性能。
其他资源
有关实现 SAIF 的从业者指南。本指南将介绍一些实用的实践知识，让您了解组织可如何着手将 SAIF 方法应用于现有或新的 AI 技术。
[null,null,["最后更新时间 (UTC)：2023-07-27。"],[[["\u003cp\u003eThe Secure AI Framework (SAIF) is designed to mitigate risks associated with AI systems, such as model stealing, data poisoning, and prompt injection.\u003c/p\u003e\n"],["\u003cp\u003eSAIF emphasizes strong security foundations, extending detection and response capabilities to encompass AI threats, and automating defenses to counter evolving risks.\u003c/p\u003e\n"],["\u003cp\u003eOrganizations should harmonize platform-level controls for consistent security, adapt controls through continuous learning, and contextualize AI system risks within their business processes.\u003c/p\u003e\n"],["\u003cp\u003eGoogle provides resources like a practitioner's guide and a report on red teaming for AI systems to assist in implementing SAIF effectively.\u003c/p\u003e\n"]]],[],null,["# Secure AI Framework (SAIF): A Conceptual Framework for Secure AI Systems\n\nAI is advancing rapidly, and it's important that effective risk management\nstrategies evolve along with it. The Secure AI Framework (SAIF) is a conceptual\nframework for secure AI systems designed to help achieve this evolution.\n\nAs AI capabilities become increasingly integrated into products\nacross the world, adhering to a bold and responsible framework will be even more\ncritical.\n| **Estimated Read Time:** 10 minutes\n| **Learning objectives:**\n|\n| - Describe the context and purpose of the SAIF framework for secure AI.\n| - Define and describe common attack scenarios for generative AI.\n\nSAIF is designed to help mitigate risks specific to AI systems, like\n[stealing the model](https://arxiv.org/abs/2004.15015),\n[data poisoning of the training data](https://arxiv.org/abs/2302.10149),\ninjecting malicious inputs\nthrough [prompt injection](https://arxiv.org/abs/2302.12173), and\n[extracting confidential information in the training data](https://arxiv.org/abs/2012.07805).\n\nThe SAIF Framework\n------------------\n\nSAIF has six core elements:\n\n### 1. Expand strong security foundations to the AI ecosystem\n\nThis includes leveraging secure-by-default infrastructure protections and\nexpertise\n[built over the last two decades](https://services.google.com/fh/files/misc/google-cloud-security-foundations-guide.pdf)\nto protect AI systems, applications,\nand users. At the same time, develop organizational expertise to keep pace with\nadvances in AI and start to scale and adapt infrastructure protections in the\ncontext of AI and evolving threat models. For example, injection techniques like\n[SQL injection](https://www.techrepublic.com/article/mandiant-malware-proliferating/#:%7E:text=According%20to%20the%20Mandiant%20report,compared%20to%2012%25%20in%202021.)\nhave existed for some time, and organizations can adapt\nmitigations, such as input sanitization and limiting, to help better defend\nagainst prompt injection-style attacks.\n\n### 2. Extend detection and response to bring AI into an organization's threat universe\n\nTimeliness is critical in detecting and responding to AI-related cyber\nincidents, and extending threat intelligence and other capabilities to an\norganization improves both. For organizations, this includes monitoring inputs\nand outputs of generative AI systems to detect anomalies and using threat\nintelligence to anticipate attacks. This effort typically requires collaboration\nwith trust and safety,\n[threat intelligence](https://cloud.google.com/blog/products/identity-security/rsa-introducing-ai-powered-insights-threat-intelligence), and counter abuse\nteams.\n\n### 3. Automate defenses to keep pace with existing and new threats\n\nThe latest AI innovations can improve the scale and speed of response efforts to\nsecurity incidents. Adversaries will\n[likely use AI to scale their impact](https://www.mandiant.com/resources/podcasts/how-adversaries-are-leveraging-ai),\nso it is important to\n[use AI and its current and emerging capabilities](https://cloud.google.com/blog/products/identity-security/rsa-google-cloud-security-ai-workbench-generative-ai) to stay nimble and cost\neffective in protecting against them.\n\n### 4. Harmonize platform level controls to ensure consistent security across the organization\n\nConsistency across control frameworks can support AI risk mitigation and scale\nprotections across different platforms and tools to ensure that the best\nprotections are available to all AI applications in a scalable and cost\nefficient manner. At Google, this includes extending secure-by-default\nprotections to AI platforms like\n[Vertex AI](https://cloud.google.com/blog/products/ai-machine-learning/google-cloud-launches-vertex-ai-unified-platform-for-mlops) and\nSecurity AI Workbench, and building controls and protections into the software\ndevelopment lifecycle. Capabilities that address general use cases, like\n[Perspective API](https://perspectiveapi.com/), can help the entire organization\nbenefit from state of the art protections.\n\n### 5. Adapt controls to adjust mitigations and create faster feedback loops for AI deployment\n\nConstant testing of implementations through continuous learning can ensure\ndetection and protection capabilities address the changing threat environment.\nThis includes techniques like reinforcement learning based on incidents and user\nfeedback and involves steps such as updating training data sets, fine-tuning\nmodels to respond strategically to attacks and allowing the software that is\nused to build models to embed further security in context (e.g. detecting\nanomalous behavior). Organizations can also conduct regular\n[red team](https://blog.google/technology/safety-security/meet-the-team-responsible-for-hacking-google/)\nexercises to improve safety assurance for AI-powered products and capabilities.\n\n### 6. Contextualize AI system risks in surrounding business processes\n\nLastly, conducting end-to-end risk assessments related to how organizations will\ndeploy AI can help inform decisions. This includes an assessment of the\nend-to-end business risk, such as data lineage, validation and operational\nbehavior monitoring for certain types of applications. In addition,\norganizations should construct automated checks to validate AI performance.\n\nAdditional Resources\n--------------------\n\nA\n[practitioner's guide](https://services.google.com/fh/files/blogs/google_secure_ai_framework_approach.pdf)\nto implementing SAIF. This guide provide high-level practical considerations on\nhow organizations could go about building the SAIF approach into their existing\nor new adoptions of AI.\n\n[Why Red Teams Play a Central Role in Helping Organizations Secure AI Systems](https://services.google.com/fh/files/blogs/google_ai_red_team_digital_final.pdf) is an in-depth report exploring\none critical capability being deployed to support the SAIF framework: Red\nteaming. This includes three important areas:\n\n1. What red teaming is and why it is important\n2. What types of attacks red teams simulate\n3. Lessons we have learned that we can share with others"]]
