AI 系統的 FedRAMP

# Extended SI controls for AI systems
SI-AI-1: Model Integrity Monitoring
  description: >
    Continuously monitor AI model behavior for drift,
    degradation, or manipulation.
  assessment_methods:
    - Periodic evaluation against benchmark datasets
    - Statistical process control on output distributions
    - Adversarial probe testing on a scheduled basis
  evidence:
    - Model evaluation reports (monthly)
    - Drift detection dashboards
    - Adversarial testing results
 
SI-AI-2: Training Data Integrity
  description: >
    Verify the integrity and provenance of all data used
    to train, fine-tune, or calibrate AI models.
  assessment_methods:
    - Hash verification of training datasets
    - Provenance tracking for all data sources
    - Statistical analysis for poisoning indicators
  evidence:
    - Data provenance documentation
    - Integrity verification logs
    - Poisoning detection scan results
 
SI-AI-3: Prompt Injection Protection
  description: >
    Implement controls to detect and prevent prompt
    injection attacks against language model components.
  assessment_methods:
    - Input filtering effectiveness testing
    - Red team prompt injection assessment
    - Output monitoring for injection indicators
  evidence:
    - Input filter configuration and test results
    - Red team assessment reports
    - Output monitoring alert logs

# AI-specific risk assessment additions for FedRAMP
ai_risk_assessment_extensions = {
    "new_asset_types": [
        {
            "asset": "AI Model",
            "classification": "Based on training data classification",
            "integrity_requirements": "High — model manipulation can "
                                      "cause incorrect decisions",
        },
        {
            "asset": "Training Data",
            "classification": "May contain PII, CUI, or classified data",
            "integrity_requirements": "Critical — poisoned data produces "
                                      "compromised models",
        },
        {
            "asset": "Embedding Database",
            "classification": "Derived from source data classification",
            "integrity_requirements": "High — manipulated embeddings "
                                      "alter retrieval results",
        },
    ],
    "new_threat_categories": [
        "Prompt injection and jailbreaking",
        "Training data poisoning",
        "Model extraction and theft",
        "Adversarial input attacks",
        "Model behavior manipulation",
        "Embedding inversion and data extraction",
    ],
}

# Authorization boundary documentation for AI components
authorization_boundary:
  ai_components:
    - component: "Fine-tuned language model"
      boundary_status: "Inside"
      justification: "Model fine-tuned and hosted within authorized environment"
      inherited_risks:
        - "Foundation model training data (outside boundary)"
        - "Pre-trained weights (sourced from model provider)"
 
    - component: "Model inference API"
      boundary_status: "Inside"
      justification: "API endpoints hosted within authorized infrastructure"
 
    - component: "Foundation model provider API"
      boundary_status: "Outside — interconnection"
      justification: "External API, documented as interconnection"
      interconnection_agreement: "ISA-2024-AI-001"
 
    - component: "Training data pipeline"
      boundary_status: "Inside"
      justification: "Data processing occurs within authorized environment"

# Continuous monitoring checks for AI in FedRAMP environments
class AIConMonChecks:
    def monthly_checks(self):
        return [
            {
                "check": "Model output distribution analysis",
                "method": "Compare current month's output distribution "
                          "to established baseline",
                "threshold": "KL divergence > 0.1 triggers investigation",
                "reporting": "Include in monthly ConMon report",
            },
            {
                "check": "Adversarial probe testing",
                "method": "Run standardized adversarial probe suite "
                          "against production model endpoints",
                "threshold": "Any new successful probe is a finding",
                "reporting": "Report as POA&M item if new vulnerability",
            },
            {
                "check": "Training data integrity verification",
                "method": "Verify hashes of training data have not changed",
                "threshold": "Any unauthorized change is a critical finding",
                "reporting": "Immediate notification to AO if changed",
            },
        ]
 
    def annual_checks(self):
        return [
            {
                "check": "Full AI red team assessment",
                "method": "Comprehensive adversarial testing including "
                          "prompt injection, data extraction, model "
                          "manipulation, and bias testing",
                "scope": "All AI components within authorization boundary",
                "reporting": "Include in annual assessment report",
            },
            {
                "check": "Model supply chain review",
                "method": "Review all model components, pre-trained weights, "
                          "and third-party model dependencies for known "
                          "vulnerabilities",
                "reporting": "Document in SSP update",
            },
        ]