| Access control and authorization |
MW.ACA-1 |
Encrypt model weights and restrict access to authorized personnel only. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Prevents unauthorized access, extraction, or replication of proprietary AI models |
| MW.ACA-2 |
Restrict access to model weights using role-based and privilege-based controls. |
- API5:2023—Broken Function Level Authorization
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
|
Ensures that only authorized personnel with appropriate roles and privileges can access model weights, preventing unauthorized access and potential theft or manipulation |
| Backup and recovery |
MW.BR-1 |
Regularly back up model weights and store them in secure locations. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Helps prevent unauthorized access, theft, and replication of the model, ensuring recovery in case of compromise |
| Cryptographic protection of model weights |
MW.CPMW-1 |
Encrypt model weights at rest and in transit to ensure confidentiality and integrity. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- ML10: Model Poisoning
|
Ensures that unauthorized access or extraction of the model is prevented, maintaining confidentiality and integrity during storage and transmission |
| MW.CPMW-2 |
Use cryptographic techniques to protect model weights during generation and storage. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Ensures that model weights are encrypted, preventing unauthorized access and extraction during generation and storage |
| MW.CPMW-3 |
Implement hardware-based encryption to secure model weights at rest. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- ML10: Model Poisoning
|
Ensures that model weights are protected from unauthorized access and extraction, preventing theft and tampering |
| Data integrity and validation |
MW.DIDV-1 |
Regularly verify and validate the integrity of model weights. |
- LLM03: Training Data Poisoning
- ML02: Data Poisoning Attack
- ML07: Transfer Learning Attack
- ML10: Model Poisoning
- BIML: Model Manipulation
|
Helps detect and prevent unauthorized modifications, ensuring that the model’s behavior remains consistent and trustworthy |
| MW.DIDV-2 |
Verify the integrity of model weights using hashing, checksums, and digital signatures. |
- LLM05: Supply Chain Vulnerabilities
- ML06: AI Supply Chain Attack
- ML10: Model Poisoning
- BIML: Model Manipulation
|
Ensures the integrity of model weights by detecting unauthorized modifications, preventing supply chain attacks, and maintaining the intended behavior of the model |
| Infrastructure security management |
MW.ISM-1 |
Ensure secure configurations for systems generating and storing model weights. |
- API8:2023—Security Misconfiguration
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
|
Ensures that systems generating and storing model weights are securely configured to prevent unauthorized access, theft, and exploitation of model weights |
| MW.ISM-2 |
Maintain a centralized inventory for production ML models with governance and access control. |
- API9:2023—Improper Inventory Management
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
|
Ensures proper documentation, governance, and access control to prevent unauthorized access, replication, or compromise of ML models |
| Network security controls |
MW.NSC-1 |
Restrict network access to authorized users for storing and transferring model weights. |
- API1:2023—Broken Object Level Authorization
- API5:2023—Broken Function Level Authorization
- LLM10: Model Theft
- ML05: Model Stealing Attack
|
Ensures that only authorized users can store and transfer model weights, preventing unauthorized access and potential theft or replication of the model |
| MW.NSC-2 |
Segment systems to protect those processing model weights. |
- API8:2023—Security Misconfiguration
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
|
Ensures that systems processing model weights are isolated from unauthorized access, reducing the risk of model theft, stealing attacks, supply chain vulnerabilities, and misconfigurations |
| Physical security controls |
MW.PSC-1 |
Limit entry to areas with sensitive data to authorized personnel only. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Helps prevent unauthorized individuals from accessing, copying, or tampering with the model weights and other sensitive components |
| MW.PSC-2 |
Implement badge systems, guards, and surveillance to control physical access. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
|
Ensures that only authorized personnel can access physical locations where model weights are stored, preventing unauthorized access and potential theft or tampering |
| Privacy-preserving techniques |
MW.PPT-1 |
Encrypt model weights and apply differential privacy techniques during model training. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML03: Model Inversion Attack
- ML04: Membership Inference Attack
- ML02: Data Poisoning Attack
- ML01: Input Manipulation Attack
|
Protects against unauthorized access to and extraction of model data, ensures training data integrity, and prevents inference attacks |
| Storage security and isolation |
MW.SSI-1 |
Store weights on secure servers, not local devices |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Prevents unauthorized access to and extraction of the model, reducing the risk of theft and tampering |
| MW.SSI-2 |
Isolate weight storage to prevent external access and interaction. |
- LLM10: Model Theft
- ML05: Model Stealing Attack
- ML06: AI Supply Chain Attack
- BIML: Model Extraction
|
Prevents unauthorized access and interaction, thereby protecting against theft of, replication of, and tampering with the model weights |
| Vulnerability management |
MW.VM-1 |
Conduct regular vulnerability scans on systems managing model weights. |
- API8:2023—Security Misconfiguration
- LLM05: Supply Chain Vulnerabilities
- LLM10: Model Theft
- ML05: Model Stealing Attack
|
Helps identify and mitigate potential security weaknesses that could be exploited to steal or compromise model weights, ensuring that systems are properly configured and secure from supply chain attacks |
| MW.VM-2 |
Regularly scan and patch systems, software, and network devices. |
- API8:2023—Security Misconfiguration
- LLM05: Supply Chain Vulnerabilities
- ML06: AI Supply Chain Attack
|
Ensures that vulnerabilities in systems, software, and network devices are identified and mitigated, preventing exploitation through misconfigurations or compromised components |
