In the rush to build AI apps, please, please don't leave security behind

Feature While in a rush to understand, build, and ship AI products, developers and data scientists are being urged to be mindful of security and not fall prey to supply-chain attacks. There are countless models, libraries, algorithms, pre-built tools, and packages to play with, and progress is relentless. The output of these systems is perhaps another story, though it's undeniable there is always something new to play with, at least. Never mind all the excitement, hype, curiosity, and fear of missing out, security can't be forgotten. If this isn't a shock to you, fantastic. But a reminder is handy here, especially since machine-learning tech tends to be put together by scientists rather than engineers, at least at the development phase, and while those folks know their way around stuff like neural network architectures, quantization, and next-gen training techniques, infosec understandably may not be their forte. Pulling together an AI project isn't that much different from constructing any other piece of software. You'll typically glue together libraries, packages, training data, models, and custom source code to perform inference tasks. Code components available from public repositories can contain hidden backdoors or data exfiltrators, and pre-built models and datasets can be poisoned to cause apps to behave unexpectedly inappropriately. In fact, some models can contain malware that is executed if their contents are not safely deserialized. The security of ChatGPT plugins ...