AI Attack Surface
Overview
AI systems introduce a fundamentally new attack surface on top of traditional application security. The model itself, its training pipeline, its data sources, and its inference API are all targets.
Attack Surface Map
┌─────────────────────────────────────────────────────────┐
│ AI APPLICATION │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────┐ │
│ │ Training │→ │ Model │→ │Inference │→ │ Output │ │
│ │ Data │ │ Weights │ │ API │ │ │ │
│ └──────────┘ └──────────┘ └──────────┘ └────────┘ │
│ ▲ ▲ ▲ ▲ │
│ Poisoning Extraction Injection Exfiltration │
│ Backdoors Adversarial Jailbreak Hallucination │
│ Supply Chain examples DoS Data leak │
└─────────────────────────────────────────────────────────┘
Mapping AI Attacks to Traditional Security
| AI Attack | Traditional Equivalent | Root Cause |
|---|---|---|
| Prompt Injection | SQL Injection | Mixing control plane and data plane |
| Jailbreaking | Privilege Escalation | Soft policy enforcement |
| Data Poisoning | Supply Chain Compromise | Untrusted inputs in build pipeline |
| Model Extraction | Reverse Engineering | Insufficient access control on outputs |
| Adversarial Examples | WAF Evasion | Input validation gaps |
| Training Data Extraction | Data Exfiltration | Model memorization, no DLP |
| Supply Chain (models) | Dependency Confusion | Unverified third-party artifacts |
Feasibility Matrix
| Attack | Access Needed | Difficulty | Impact |
|---|---|---|---|
| Prompt Injection | App user | Low | High |
| Jailbreaking | Chat access | Low-Medium | Medium |
| Supply Chain | Public repo | Medium | High |
| Training Data Extraction | API access | Medium | High |
| Model Extraction | API + compute | Medium | Medium |
| Adversarial Examples | Model weights ideal | Medium-Hard | High |
| Data Poisoning | Training pipeline | Hard | Critical |
Key Principle
The attacks easiest to execute (prompt injection, jailbreaking) target the runtime layer and require nothing more than typing. The attacks with highest impact (data poisoning, backdoors) require deep pipeline access. Same tradeoff as traditional security — easy attacks hit the perimeter, devastating attacks require insider access.