When asked to write about why AI security matters and describe some of the work we are doing at ARLIS, I decided to run a small experiment. I clicked through a range of news sites and social media feeds to see how long it would take to find someone talking about AI security. Of the twenty or so sites I checked, only one required I leave the main page. Evidence that AI security matters are everywhere. The harder question is what we mean by “AI security.”
It can mean protecting AI systems from attack or protecting people and organizations from malicious uses of AI. It includes intellectual property, data, software, hardware, supply chains, infrastructure, and the economic and national-security consequences of failures across those layers. These problems are not independent. A weakness in hardware can propagate into software. A compromised model or dataset can affect downstream systems. Supply-chain decisions can create risks far beyond where the problem began.
At ARLIS, we approach AI security as both a research problem and an engineering problem. We examine where models may have come from, whether they have been modified, what distinguishes one model from another, and what evidence can support claims about provenance or copying. We also develop automated testing methods that expose models to repeatable adversarial scenarios and allow results to be compared across systems and over time.
AI security goes beyond the traditional stack, and, at ARLIS, we explore how model behavior changes in use: how to explain it, how interventions affect it, and how those changes shape human-machine interaction and teaming. Security does not end at the model boundary. Risk depends on the model, the user, the task, and the environment in which the system operates. A system that is acceptable in one context may create unacceptable risk in another.
Taken together, this work is about building evidence. We want to understand what a model is, where it came from, how it normally behaves, and how it changes under pressure. A model might resemble another without having been copied from it. It might refuse an obvious malicious request while remaining vulnerable to a less obvious attack. Good vetting must also tell us when the available evidence is too weak to support a conclusion.
Recent events make the problem concrete. During cybersecurity testing this summer, OpenAI models circumvented controls intended to isolate them, gained unintended internet access, and accessed systems belonging to Hugging Face. OpenAI later called the incident a “warning shot.” Anthropic has also reported cases in which AI reduced the skill and labor needed for sophisticated cyber operations. Frontier AI leaders have increasingly argued that security and evaluation need to keep pace with rapidly advancing capabilities.
The pace and complexity of the environment also make purely manual security difficult. Attackers use AI to search for weaknesses, automate parts of attacks, and operate at greater scale. Defensive systems increasingly need comparable speed and adaptability.
AI security is not a single problem, and it cannot be checked once before deployment. It is an ongoing process of understanding systems, testing assumptions, finding failure modes, and deciding whether the evidence supports using a particular system for a particular purpose.