World's Fair 2025
How to Build Trustworthy AI — Allie Howe
Overview
This talk addresses the critical need for building trustworthy AI systems, emphasizing that responsibility ultimately lies with the user and developer. It defines trustworthy AI as a combination of AI security (protecting AI from external harm) and AI safety (preventing AI from harming the world). The presentation advocates for a shift from traditional DevSecOps to MLSecOps, highlighting the importance of integrating security and safety practices throughout the AI development lifecycle, from build to runtime.
Who should watch
- AI Engineers and Developers
- Product Managers and Builders
- Security Professionals
- Anyone responsible for deploying AI applications
- Those concerned with AI compliance and reputation
Key takeaways
- Trustworthy AI is essential due to incidents like the Chevy Tahoe chatbot error and Slack data leaks, underscoring the potential for significant consequences when AI systems are not secure or safe.
- The responsibility for AI's actions, both legally and reputationally, falls on the user and developer, as demonstrated by a lawsuit where OpenAI was dismissed because users are expected to proceed with caution.
- Building trustworthy AI requires a cross-functional effort involving product, security, and engineering teams, focusing on relevance, helpfulness, appropriateness, and protection against threats like prompt injections.
- The paradigm is shifting from DevSecOps to MLSecOps, recognizing that AI engineers work in environments like DataBricks and Jupyter notebooks, necessitating new security approaches.
- AI security requires a "shift right" approach, with runtime security being particularly crucial due to the non-deterministic nature of AI and the rapid evolution of threats like prompt injections.
- MLSecOps involves practices like model scanning for vulnerabilities (e.g., model serialization attacks using pickle), AI red teaming to simulate threats and test for safety concerns, and implementing AI runtime security.
- AI runtime security is presented as a high-impact area to invest in, offering easier implementation than extensive red teaming and providing continuous validation of AI inputs and outputs.
- Building trustworthy AI is not only a security imperative but also a business advantage, aligning cybersecurity and business risks, enhancing revenue potential, and preparing for an increasing regulatory landscape.
Notable quotes
*Trustworthy AI is AI security, which is how does the world harm your AI application plus AI safety, which is how does your AI application harm the world.*
*You are responsible for building trustworthy AI.*
*Don't wait to get yourself into a lawsuit. Start building trustworthy AI today.*
Unofficial community note. Prefer the recording for nuance.