The Institute for Ethical AI & Machine Learning

The MLSecOps Top 10

The MLSecOps Top 10 is an initiative that aims to further the field of machine learning security by identifying the top 10 most common vulnerabiliites in the machine learning lifecycle. This project aims to provide an evaluation of security vulnerabilities analogous to the "OWASP Top 10 Report" but with a focus on machine learning security.

The MLSecOps Top 10 also includes a set of practical hands-on examples of each of these vulnerabilities, as well as the best practices to address them - all the content is available open source. If you're interested to learn more or get involved, get in touch.

The MLSecOps Top 10

Combining cutting edge research tools with best practices & processes to ensure machine learning systems are secure and undesired vulnerabilities are mitigated. Check out the resources and video below which cover MLSecOps from a conceptual and practical perspective.

The MLSecOps Top 10 is open source, and converts the Principles for Responsible Machine Learning into a practical tool + process approach.

Contributing to Trusted AI

We are currently contributing to the Linux Foundation Trusted AI Group as organisational member on the Machine Learning Security committee to define cross-functional principles and resources.

Free as in freedom

The MLSecOps Top 10 is open source and it is available at GitHub.

Maintained with ♥ by our members

The codebase is maintained by the Ethical AI Network which is a global community of technologists and domain experts

The MLSecOps Top 10 Vulnerabilities

The table below outlines the top 10 vulnerabilities for both the Open Web Application Security Project (OWASP) as well as the MLSecOps equivalent. You will be able to find a hands on set of examples to understand the "Flawed Machine Learning" cases together with solutions in the project repository.

#	OWASP Vulnerability	MLSecOps Equivalent
1	Broken Access Control	Unrestricted Model Endpoints
2	Cryptographic Failures	Access to Model Artifacts
3	Injection	Artifact Exploit Injection
4	Insecure Design	Insecure ML Systems/Pipeline Design
5	Security Misconfigurations	Data & ML Infrastructure Misconfigurations
6	Vulnerable & Outdated Components	Supply Chain Vulnerabilities in ML Code
7	Identification & Auth Failures	IAM & RBAC Failures for ML Services
8	Software and Data Integrity Failures	ML Infra / ETL / CI / CD Integrity Failures
9	Logging and Monitoring Failures	Observability, Reproducibility & Lineage
10	Server-side Request Forgery	ML-Server Side Request Forgery

If you are curious to learn more about the OWASP Top 10 you can check out the official report website. Below you can see a preview of each the report for 2017 compared to the 2021 highlights.

Check out our hands on case study where we introduce the MLSecOps Top 10 vulnerabilities through hands on examples showcasing "Flawed Machine Learning", and then providing best practices and tools that can be used to address some of these machine learning security considerations. Watch the technical video below.