Elementary threats
to AI systems.

Poisoning can affect training data, fine-tuning data or retrieved knowledge at several points in the supply chain. Pre-trained models can also contain hidden backdoors or altered parameters that take effect after adoption.

Malicious instructions may arrive directly or be hidden in external material the system processes. This report also includes adversarial input changes that cause other AI models to misclassify data.

Hallucinated references, errors in generated code and reduced accuracy on changed inputs can pass unnoticed. Faulty generalisation, model drift or limited robustness can make apparently plausible results unreliable.

Queries can reveal training records, whether particular data was used in training, or confidential system instructions. Memorised information and insufficient separation between users can also lead to disclosure.

Unbalanced or flawed source data can carry existing prejudices into results, while model design can amplify them. This can produce unequal treatment or differing levels of accuracy across groups.

Limited explainability and inadequate documentation can prevent organisations and affected people from understanding the basis of a result. This makes errors, bias and manipulation harder to investigate.

Broad permissions, uncontrolled tool calls or missing approval steps can let an agent act without an effective boundary. Overreliance on the system’s decisions can further reduce oversight.

Consumption can vary with inputs and model behaviour, making per-request demand hard to anticipate. Agent loops can also consume the quotas, compute time and storage of connected services without an external attack.

Generated commands, queries or code can cause harm when validation and encoding are missing at the integration boundary. The issue is that the output takes effect unchecked, whether it was maliciously influenced or unintentionally wrong.

Repeated queries can reveal enough behaviour to train a substitute, while stolen weights or artefacts allow direct reuse. The protected asset is the model itself, distinct from sensitive data inferred from it.

Incoming audio, images, video or text can impersonate trusted people in communication and approval processes. An organisation’s own generated content can also lose traceable origin when labelling is absent or provenance information is removed or falsified.