A Basic Guide to Security for Different AI Models

Published in

Centric Tech Views

9 min readJul 30, 2024

By Joseph Ours, AI Strategy Lead, and David Lefever, Cybersecurity Consulting Services Lead

Woman in business attire looking at her phone — By applying cybersecurity principles and tools, you protect these processes from those who want to exploit them.

Discover the security considerations for different AI models and adjacent technologies, including ML, RPA, and LLMs. We provide actionable insights to help you implement these technologies securely.

With the rapid expansion of artificial intelligence (AI), cutting-edge technologies like machine learning (ML), robotic process automation (RPA), and large language models (LLMs) are becoming widespread across many sectors.

While these advancements offer exciting opportunities for innovation, efficiency, and growth, it’s also important to consider the new risks and challenges of AI cybersecurity.

A Brief Review of AI, ML, RPA, and LLMs

AI, ML, RPA, and LLM systems are technology solutions that often intersect. Here’s what they involve:

· Artificial intelligence. AI is a broad term for technology focused on building systems that mimic human intelligence or perform tasks humans typically have to do.

· Machine learning. ML is a branch of AI that uses algorithms to empower computers to learn and make predictions. As you expose ML technologies to more high-quality data, they learn how to improve outcomes either with the help of a human or without.

· Robotic process automation. Like AI, RPA uses ML to accomplish tasks that humans would normally have to tackle. An RPA system uses computer scripts or bots to automatically perform repetitive tasks. Users can also combine RPA with AI and ML to create hyperautomation, or the complete automation of all business processes.

· Large language model. An LLM is a branch of AI built to produce and understand human language. Data scientists use huge amounts of data to train an LLM to comprehend and imitate human speech or writing. ChatGPT, for example, runs based on an LLM.

These technologies are interconnected because they use automated computer systems to work. However, ML, RPA, and LLMs are more intimately intertwined because they are all branches that extend from AI.

Key Similarities and Differences Between These AI Technologies

It’s important to understand the connection — and differences — between AI, ML, RPA, and LLMs, especially in the context of AI security risks.

LLMs focus on learning and generating language, which makes them different from regular ML solutions, which may or may not involve language reading or generation.

At the same time, LLMs depend on ML to function because they use it to learn the languages they produce and interact with. This is significant in cybersecurity because to corrupt an LLM, a hacker only has to compromise the ML that powers it.

Despite the risk, combining systems that use these technologies brings you closer to fully automated, human-like machines. ML enables AI systems to improve themselves with little or no human intervention. This means an organization can acquire an ML system that teaches itself to be more accurate over time. When you introduce LLMs to the mix, you give AI and ML solutions the ability to naturally communicate with humans.

This isn’t to say that RPA has a less significant role, especially when it is combined with both AI and ML.

For example, RPA engineers have used AI to improve the performance of RPA systems. They use artificial neural network algorithms, text mining, and natural language processing (NLP) to enhance the functionality of RPA tools. By combining AI and RPA in this way, engineers improve operational processes and business outcomes.

Use Cases for AI Technology Solutions

Understanding how companies use AI, ML, RPA, and LLMs makes it easy to see the security risks they may pose.

For example, a healthcare organization may use an ML app to analyze X-rays and other imagery to detect disease. The app would use ML to learn what to look for in each image and then assess the probability of the image indicating specific conditions.

Suppose a hacker working for a foreign entity were to introduce misleading data into a hospital’s ML imagery analysis system. This could cause the system to either misdiagnose symptoms or miss indicators of disease, putting the health of the hospital’s patients at risk.

Let’s dig a little deeper into the cybersecurity issues that these technologies could present and how you can mitigate them.

Key Cybersecurity Considerations: Risks and Challenges

By identifying the cybersecurity challenges associated with each tool, you can set up systems that mitigate these concerns and reduce risk.

Here’s a breakdown of some of the security issues these technologies pose and why they could be problematic for your organization.

Data Privacy

AI, ML, and LLMs all use data sets — in one way or another — to perform their tasks. If an attacker were to gain unauthorized access to a data set that one of your systems uses, then large amounts of sensitive information could fall into the wrong hands.

Data Corruption or Poisoning

Attackers can intentionally corrupt the data an AI, ML, or LLM system uses, resulting in unreliable or misleading outputs. For instance, a paper published by the National Institute of Standards and Technology (NIST) explains how attackers can alter the contents of data used by AI systems to invalidate their results. If an LLM uses corporate documents to answer questions, a hacker who alters those documents can render the LLM ineffective.

Tampering with Automated Processes

If an attacker gains access to what drives an automated RPA or AI-powered process, they can change how it functions. In this way, a hacker can sabotage the system or even manipulate its outputs to their own advantage.

For instance, in late 2023, hackers found a way to hack Microsoft’s OAuth system. OAuth provides automation that gives applications the ability to access data and resources using permissions set up by users. By compromising user accounts, threat actors have been able to establish and change privileges to OAuth applications and then misuse the apps to hide nefarious activity. For instance, hackers have manipulated OAuth automation to deploy virtual machines that are engaged in mining cryptocurrency.

Why Leaders Must Prioritize Security When Implementing AI Technologies

When working with AI solutions, prioritizing security is important because a successful attack can affect both sensitive data and your operational infrastructure.

Since AI solutions often depend on large sets of data, a single breach can give a hacker access to vast stores of sensitive information. This can result in:

· Less confidence and trust in your organization by customers

· Expensive breach mitigation measures

· Lawsuits from customers and users impacted by the breach

· Compliance issues for systems designed to protect sensitive data

By securing your systems, you also avoid operational issues. For instance, suppose an attacker were to poison a database used by an LLM to answer customer questions. Suddenly, users start getting incorrect responses. In addition to the reputational damage this could cause, customer service reps may have to interrupt their regular work to make sure clients get accurate answers to their questions.

Best Practices for Securing Your AI Systems and Data

The good news is you can use plenty of tools and best practices to safeguard your AI and RPA processes and their data. Here’s how:

· Encrypt all data. Whether your data is at rest or in transit, encrypting it makes it useless for attackers. Even if a hacker were to penetrate your system, they would merely see a jumbled mix of characters instead of valuable, sensitive data.

· Deploy vigorous access control systems. For example, if you use multifactor authentication, you can stop attackers who only have a username and password.

· Use a role-based access system. You should allow people access to data and sensitive areas of your system only if they absolutely need it to do their jobs. For instance, you can provide access to an RPA bot’s programming to only a few data scientists, excluding even senior executives from accessing your system.

· Continually test every AI model and RPA solution. By performing regular tests, you limit the amount of time a hack can impact your system. In some cases, you may be able to automate elements of your testing and save valuable time.

· Ensure you have a logging and monitoring solution in place. This makes it easier to catch attacks earlier, and your logging solution also streamlines the troubleshooting process.

· Segment network-hosted systems using firewalls. A firewall can prevent unauthorized access and stop malware from entering your system. In addition, a firewall can detect data exfiltration attacks and instantly close access to the target system.

How to Stay Ahead of Emerging Cybersecurity Threats

Even though the threat landscape is evolving, you can remain a step ahead with these actions:

· Subscribe to cybersecurity newsletters and leading publications, which outline the most recent threats.

· Constantly check for the latest encryption protocols to best protect the data your AI and RPA systems use.

· If you have cybersecurity tools, such as firewalls, web application firewalls (WAFs), or antimalware, make sure they’re up to date and configured to detect the latest threat signatures.

· Periodically perform penetration tests to check for new vulnerabilities.

Future AI Trends and Opportunities

The future for AI, ML, LLMs, and RPA is promising, with a few trends prominent on the horizon:

· Using AI to turn RPA into IPA. IPA, or intelligent process automation, has already begun to play a role, but as AI, LLMs, and ML play an increasingly prominent role in the development lifecycle, data scientists will build more and more IPA solutions.

· Focusing more on ethics. Whether fostering workplace equity or dialing back automaticity to prevent rogue AI, many engineers are invested in creating more ethical solutions.

· Using advanced silicon for faster processes. Technologies such as photonic computing have the potential to process vast amounts of data very quickly. This can make real-time, data-heavy AI and RPA solutions more feasible across industries.

For example, students can use low-code and no-code platforms in the education sector to build innovative solutions — even before they leave high school. This levels the playing field by lowering barriers to entry.

In the energy and utility sector, carefully monitoring ML apps that balance water usage or the power grid can prevent significant public health issues. For instance, suppose the power plant that sends energy to a specific town uses expensive, nonrenewable sources. By setting up checks and balances on an ML designed to boost efficiency and sustainability, you can prevent it from shutting down power to that town.

Similarly, by incorporating ethical principles, you can limit AI’s negative impact on vulnerable populations. Consider:

· Regularly testing your AI system to detect biases

· Being transparent — both with employees and investors — when it comes to how your organization uses AI and RPA

· Prioritizing using RPA and AI to help people do their jobs instead of merely replacing them with robots

· Making sure all individuals whose data you collect understand how you use their information

· Setting up guidelines for ensuring accountability for the design, implementation, and management of your AI and RPA systems

Also, by training employees to use and build RPA and AI solutions, you give them ways to insulate their employment from the effects of automation technologies. In this way, you empower your workforce by giving them cutting-edge knowledge they can use to develop innovative solutions. You also help them see AI and RPA as partners rather than competitors.

Boost Your Cybersecurity Awareness for Safer AI, ML, LLMs, and RPA

AI, ML, LLMs, and RPA introduce novel ways of automating time-consuming and inefficient processes. By applying cybersecurity principles and tools, you protect these processes from those who want to exploit them.

It’s best to stay informed and engaged so you know the latest innovations these technologies bring and cutting-edge ways of safeguarding them from attackers.

Here are some resources to get you started:

· AI Strategic Planning, Governance and Security

· Secure Work Environment

· Virtual CISO Services & Cybersecurity Strategy

· Robotic Process Automation

· Artificial Intelligence A–Z 2024: Build 7 AI + LLM & ChatGPT