Model versus system
Classify the model, wrapper, data path, identity, tool, and downstream side effect separately. The same model can have a different risk profile when connected to different authority.
Published source
This course chapter is based on the published article: AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations.
The local page preserves the chapter’s media references and connects them to the course’s terminology, architecture, and security evidence workflow. Infographics are reproduced from the author’s publication for course use; video links open the original YouTube destinations.
Chapter contents
Why the foundation matters
An AI system is not just a model. It is a chain of data pipelines, artifacts, prompts, retrieval systems, applications, identities, tools, memory, infrastructure, operators, and downstream actions. A generated answer or model score does not automatically provide authorization, tenant isolation, provenance, auditability, or safe execution.
Symbolic rules still matter
Explicit rules, policies, allowlists, and search procedures are security-critical artifacts even when no parameters are learned. Preserve their versions, evaluation order, inputs, and decision path.
Evidence before labels
Distinguish a confirmed incident, provider observation, disclosed vulnerability, malicious artifact, demonstrated research result, forecast, and constructed scenario.
Security outside the model
Authorization, identity, tenant isolation, output validation, egress, logging, and rollback remain application and platform responsibilities.
The taxonomy in one view
These terms overlap, but they are not synonyms. The label changes the security question.
Artificial intelligence
├── symbolic rules, search, planning, knowledge, optimization, robotics
└── Machine learning
├── classical statistical and algorithmic ML
└── Deep learning
├── discriminative and representation models
├── embedding models
├── generative models
└── foundation models
├── language models and LLMs
├── vision models
└── multimodal models| Term | What it means | Security question |
|---|---|---|
| AI | The broad field of systems producing predictions, recommendations, decisions, or content. | Which component has authority and what state can it change? |
| Symbolic rules | Explicit human-authored conditions, facts, policies, and actions. | Can inputs bypass, confuse, or reorder the policy path? |
| Machine learning | Behavior learned from data or interaction rather than only hand-written rules. | Who can influence training data, labels, features, feedback, or thresholds? |
| Deep learning | Multilayer neural networks that learn representations and functions. | What was learned, under which distribution, and what happens under shift or evasion? |
| Generative AI | Systems that produce text, code, images, audio, video, or structured content. | Where are output validation, encoding, identity, and egress enforced? |
| Foundation model | A broadly trained reusable starting point for downstream applications. | Is provenance known, is loading safe, and are adapters and revisions controlled? |
| LLM | A language model that predicts and generates sequences of tokens. | Which application controls provide truth checks, authorization, and safe tool execution? |
Infographics from the publication
These are the nine visual assets included with the published chapter. Open any image in a new tab for the locally preserved full-size course copy.
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Open image ↗
Video references from the publication
The original article included five YouTube references. They are linked directly here so the course page remains usable without embedding third-party players.
- 01. Machine-learning overview and the transition from AI concepts to learned behaviorWatch on YouTube ↗
- 02. Deep learning and multilayer representationsWatch on YouTube ↗
- 03. Generative AI and produced contentWatch on YouTube ↗
- 04. Foundation models and reusable model capabilitiesWatch on YouTube ↗
- 05. Large language models and language generationWatch on YouTube ↗
Real security cases
The chapter uses cases to show why taxonomy matters. Each case has different evidence, target assets, and controls.
| Case | Evidence and lesson |
|---|---|
| ShadowRay | Reported exploitation of exposed Ray infrastructure. The platform around AI workloads can expose models, datasets, credentials, and expensive compute. |
| Malicious model artifacts | Public ML artifacts can carry unsafe loading behavior or backdoors. Model provenance, format, loader, and admission controls are supply-chain controls. |
| CVE-2025-32711 / EchoLeak | A disclosed enterprise-AI vulnerability illustrates how retrieved content, instructions, rendering, and outbound paths can combine into impact. |
| MCP tool poisoning | Tool metadata can influence an agent’s planning context. Pin definitions, scope delegated identity, require authorization outside the model, and log approvals. |
Evidence rule: a demonstrated vulnerability, a provider observation, a confirmed incident, and a constructed scenario must not be reported as if they were the same thing.
Data foundations: the security objects
The published Part 1 also introduces the objects security teams must separate during development and incident response.
| Object | Example | What to preserve |
|---|---|---|
| Data | Phishing messages, RAG documents, prompts, retrieved passages, and feedback. | Source, owner, access policy, provenance, content hash, split, retention. |
| Features | URL features, pixel tensors, token IDs, or embedding vectors. | Extraction code, tokenizer/embedding version, normalization, validation. |
| Labels | phishing/benign, severity, entity spans, or preference choices. | Label policy, source, annotator, confidence, disagreement, policy version. |
| Parameters | Weights, biases, embedding tables, or adapter weights. | Digest, signature, parent checkpoint, adapter list, format, loader. |
| Hyperparameters | Learning rate, threshold, retrieval top-k, temperature, or max output. | Versioned configuration beside the model artifact and release decision. |
| Training / validation / testing | Optimization, development choices, and held-out evaluation. | Code, manifests, split rules, seeds, environment, metrics, exceptions. |
| Inference | A classification, generated answer, embedding, or proposed tool call. | Caller, tenant, model route, context, retrieval, policy, output, side effect. |
Chapter checkpoint
Explain
Distinguish AI, symbolic rules, ML, deep learning, generative AI, foundation models, and LLMs without using the labels as synonyms.
Trace
Identify the data, features, labels, parameters, hyperparameters, and inference boundary in a phishing classifier or RAG assistant.
Classify evidence
State whether a case is a confirmed incident, disclosed vulnerability, demonstrated research result, malicious artifact, or constructed scenario.
Preserve
Name the artifact, configuration, identity, context, tool definition, output, and downstream action needed to reconstruct a security event.