Security Overview
Security and privacy for AI applications: threat models, data protection, compliance frameworks, and defense-in-depth.
Last updated
After this section you can
- Deliver the 30-second security answer in an interview: STRIDE threat model over the system's data flows, the seven defense layers with what each stops, and who owns the residual risk
- Map the OWASP Top 10 for LLM Applications (2025) to concrete controls and to the deep-dive sections of the Security & Safety part
- Threat-model a support agent with RAG and a ticket tool using STRIDE, tying each of the six categories to a specific mitigation and the section that teaches it
- Walk an indirect prompt-injection chain (poisoned doc → injected instruction → tool call → exfiltration attempt) layer by layer, citing EchoLeak (CVE-2025-32711) as the production precedent
Security Overview
The pillar that quietly fails FDE candidates: they recite acronyms instead of threat-modeling the system in front of them. The hub for the Security & Safety part.
Ask ten candidates to “talk about security” for an LLM support agent and nine answer “IAM, encryption, SOC 2” and stop. That fails twice: it names controls with no threat they defend against, and it ignores what makes an LLM app different — the model reads untrusted text as instructions, retrieved data becomes prompt content, outputs are actions with side effects. The passing answer has a thirty-second shape: threat model first, then layered defenses, then ownership.
“I’d start from a threat model, not a control list: walk the data flows with STRIDE and mark every trust boundary — user input, retrieved documents, tool calls, the provider API. Then defenses in layers: identity and least privilege, PII redaction before the model, injection screening on everything the model reads, tenant isolation, encryption with our own keys, immutable audit logs, zero retention at the provider. Finally, ownership: which risks we accept, who signs them, and how each control maps to SOC 2 / GDPR evidence.”
Threat model → layers → ownership — the skeleton for this whole part.
You built the failure taxonomy in SD-9 · Agent Failure Modes — loops, tool errors, context rot, cascading hallucinations. Security failures are the same mechanics with one difference: an adversary causes them on purpose. This is the hub; the deep-dives carry the code and configs.