CWE-1448

This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.

Use this View or other Views to search and navigate for the appropriate weakness.

Maintenance

This view is likely to be updated frequently in future versions. See Research Gaps.

Research Gap

As of CWE 4.20, it is still difficult to distinguish common AI/ML related attacks from the underlying weaknesses. The CWE AI Working Group has had many discussions about this general topic. Much of the latest research has focused on the attacks, and/or characterizing the underlying design and implementation of AI/ML related systems. From a CWE perspective, the distinction between "control" and "data" is not necessarily as deep as currently considered within the AI/ML community, since most weaknesses are characterized in terms of potentially insecure "behavior" - whether that behavior occurred due to design, insecure code, insecure configuration, or data-driven behaviors such as AI/ML. Since AI/ML is frequently derived from repositories of software that consume AI/ML components - many public reports of AI/ML vulnerabilities ultimately result from commonly-occurring weaknesses that appear in most kinds of software. There are several weakness-focused research efforts within the industry, but these efforts are still in the early stages.