読み込み中...
Supply Chain Attacks
Testing AI model and data supply chain security vulnerabilities
利用できる手法
AI Model Poisoning
(AMP)Injection of malicious data into AI training datasets to corrupt model behavior, causing models to learn incorrect patterns or exhibit harmful behaviors.
主な特徴
- •Training data manipulation
- •Gradual behavior modification
- •Trigger-based activation
Primary Defenses
- •Data validation and sanitization
- •Source verification and digital signatures
- •Statistical anomaly detection
Key Risks
Malicious Model Distribution
(MMD)Distribution of compromised AI models through legitimate channels like model repositories, containing hidden malicious functionality or backdoors.
主な特徴
- •Repository infiltration
- •Typosquatting attacks
- •Version poisoning
Primary Defenses
- •Model signature verification
- •Automated security scanning
- •Reputation-based filtering
Key Risks
AI Dependency Confusion
(ADC)Exploitation of package management systems to inject malicious AI libraries or dependencies into AI development workflows.
主な特徴
- •Package name similarity
- •Version number manipulation
- •Automated installation triggers
Primary Defenses
- •Package pinning and lock files
- •Private package repositories
- •Dependency scanning tools
Key Risks
AI Library Vulnerability Exploitation
(ALVE)Exploitation of security vulnerabilities in popular AI/ML libraries and frameworks that are widely used in the AI development ecosystem.
主な特徴
- •Known CVE exploitation
- •Zero-day vulnerability discovery
- •Framework-specific attacks
Primary Defenses
- •Regular security updates
- •Vulnerability scanning automation
- •Runtime protection mechanisms
Key Risks
Ethical Guidelines for Supply Chain Attacks
When working with supply chain attacks techniques, always follow these ethical guidelines:
- • Only test on systems you own or have explicit written permission to test
- • Focus on building better defenses, not conducting attacks
- • Follow responsible disclosure practices for any vulnerabilities found
- • Document and report findings to improve security for everyone
- • Consider the potential impact on users and society
- • Ensure compliance with all applicable laws and regulations
このカタログを作ったエンジニアが担当
あなたのエージェントシステムをレッドチーミング
ここに収録された攻撃は、本番のエージェントシステムに対して日々成立しています。誰かに悪用される前にテストしましょう。プロンプトインジェクション、ジェイルブレイク、ツールの悪用、データ持ち出しまで、すべての指摘に修正方法を添えてお渡しします。
€750（通常€1,500）・1週間・文書レポートとウォークスルーコール・9月30日まで