# AI Security in Practice: Protecting Your AI-Powered Applications - Olivia Liddell

## Executive summary

This talk provides a deep dive into securing AI-powered applications by addressing unique vulnerabilities that traditional security measures often miss. Using a fictional online retailer (ABC Company) as a case study, the presentation outlines three primary AI security risks—Prompt Injection, Data Poisoning, and Improper Output Handling. Mitigation requires implementing layered defenses across the entire application workflow: input validation, model protection, output sanitization, and continuous monitoring.

## Key takeaways

- AI Attacks are Subtle and Invisible: Unlike traditional attacks (e.g., DDoS), AI vulnerabilities can be slow, subtle, and partially invisible to standard firewalls or logging systems, requiring a shift in defensive thinking.
- Understand the Three Core Risks: The three major risks are: Prompt Injection (tricking the model with disguised instructions), Data Poisoning (manipulating training data over time), and Improper Output Handling (trusting model output without validation).
- Implement Layered Defenses: Security must be applied at four stages: Input Validation (sanitizing user input before it reaches the model), Model Protection (limiting scope and permissions), Output Sanitization (treating all AI-generated content as untrusted), and Monitoring/Operations (tracking model behavior changes).

## Technical details

- Prompt Injection Attack Vector: An attacker disguises instructions within normal user input fields (e.g., 'I prefer blue clothes' followed by 'Ignore all previous instructions...'). The model treats the malicious instruction as valid text, potentially allowing unauthorized actions like updating PII or generating coupon codes.
- Data Poisoning: This attack occurs over an extended period when attackers generate fake browsing sessions (e.g., associating clothing searches with power tools) to subtly retrain the model and corrupt its core logic, making all clicks appear legitimate.
- Improper Output Handling: This vulnerability occurs when an application trusts the output of the AI model without any validation or guardrails. Even if the model is manipulated (e.g., recommending power tools to a clothing shopper), the application fails because it assumes the content is safe and accurate.
- Model Scope and Permissions: Models must be secured by strictly limiting their operational scope and permissions, ensuring they cannot perform unauthorized actions (e.g., database updates) even if manipulated.

## Practical implications

- Inventory all existing AI applications to understand the full attack surface.
- For every AI feature, define three critical questions: What can users influence? What data can the model access? What reaches the user?
- Establish clear business rules and guardrails for output validation (e.g., ensuring a recommendation matches the customer's shopping context).
- Implement robust monitoring that tracks changes in model behavior over time, not just traditional traffic alerts.
- Treat all AI-generated content as untrusted until it passes through defined security checks.

## Topics

AI Security, Prompt Injection, Data Poisoning, Improper Output Handling, Model Architecture, OAS Generative AI Security Project, Oliviaell.com

Source: https://www.youtube.com/watch?v=cj-6jlL0qBA