arXiv 2502.086102025-07-26cs.CRcs.AI

量化安全漏洞：当前 AI 标准差距的指标驱动安全分析

Quantifying Security Vulnerabilities: A Metric-Driven Security Analysis of Gaps in Current AI Standards

University of Guelph（圭尔夫大学）

Keerthana Madhavan, Abbas Yazdinejad, Fattane Zarrinkalam, Ali Dehghantanha

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文审计 NIST AI RMF、英国 ICO Toolkit 与欧盟 ALTAI，提出 RSI、AVPI、CSGP、RCVS 四项指标量化其安全差距，并给出改进建议。

摘要：

随着 AI 系统融入关键基础设施，AI 合规框架中的安全差距迫切需要关注。本文审计并量化了三大 AI 治理标准中的安全风险：NIST AI RMF 1.0、英国 AI and Data Protection Risk Toolkit，以及欧盟 ALTAI。我们采用一种新颖的风险评估方法，制定了四项关键指标：Risk Severity Index（RSI，风险严重程度指数）、Attack Potential Index（AVPI，攻击潜力指数）、Compliance-Security Gap Percentage（CSGP，合规—安全差距百分比）和 Root Cause Vulnerability Score（RCVS，根本原因漏洞评分）。分析在各框架中识别出 136 项关切，暴露出显著差距。NIST 未能处理 69.23% 的已识别风险；ALTAI 具有最高的攻击向量脆弱性（AVPI = 0.51）；ICO Toolkit 的合规—安全差距最大，80.00% 的高风险关切仍未解决。根本原因分析强调，流程定义不足（ALTAI RCVS = 033）和实施指导薄弱（NIST 与 ICO RCVS = 0.25）是关键弱点。这些发现强调，AI 合规需要更强、可强制执行的安全控制。我们提供有针对性的建议，以改善安全态势并弥合合规与现实 AI 风险之间的差距。

英文摘要：

As AI systems integrate into critical infrastructure, security gaps in AI compliance frameworks demand urgent attention. This paper audits and quantifies security risks in three major AI governance standards: NIST AI RMF 1.0, UK's AI and Data Protection Risk Toolkit, and the EU's ALTAI. Using a novel risk assessment methodology, we develop four key metrics: Risk Severity Index (RSI), Attack Potential Index (AVPI), Compliance-Security Gap Percentage (CSGP), and Root Cause Vulnerability Score (RCVS). Our analysis identifies 136 concerns across the frameworks, exposing significant gaps. NIST fails to address 69.23 percent of identified risks, ALTAI has the highest attack vector vulnerability (AVPI = 0.51) and the ICO Toolkit has the largest compliance-security gap, with 80.00 percent of high-risk concerns remaining unresolved. Root cause analysis highlights under-defined processes (ALTAI RCVS = 033) and weak implementation guidance (NIST and ICO RCVS = 0.25) as critical weaknesses. These findings emphasize the need for stronger, enforceable security controls in AI compliance. We offer targeted recommendations to enhance security posture and bridge the gap between compliance and real-world AI risks.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。