Threat Modeling Meets Model Training: Web App Security Skills...
summary
Central claim: existing web app security techniques mostly cover LLM risks, so teams can threat model AI by applying sanitization, access controls, and CI-style testing. Concrete practices recommended include limiting LLM access to specific API endpoints, gating costly calls behind auth, adding human confirmation for state changes, using RAG sparingly and monitoring sources, and writing a unit test for every bug. Watch for prompt injection, use retrieval-augmented generation carefully, and prefer vendors with model cards and incident capacity.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:45AI in modern applications
- 5:54Cross-site scripting in AI
- 8:00Authentication and access control
- 10:27Data handling and guardrails
- 14:19Third-party models and libraries
- 15:42Prompt injection explained
- 18:31Hallucinations and unreliable output
- 21:20Moving to a new AI model
- 22:47Applying web security to AI
- 24:33Key takeaways and resources
- 26:51Q&A session
related talks
41mThreat Modelling for ML/AI systems
25mThreat Modeling for AI Apps with Attacks as Code
45mThreat Modeling in the Age of AI
20mSecurity Threats in Modern LLM Applications
57mUnlocking Threat Modeling
01h 01mIntroduction to AI Security
39mThreat Modeling Using LLMs
18mCommit Secure AI: Embedding Security in Code, Pipelines, and Production