Securing.AI – AI Security, Safety and Privacy

January 1, 2024

Marin’s Statement on AI Risk

April 7, 2024

The Dual Risks of AI Autonomous Robots: Uncontrollable AI Meets Cyber-Kinetic Risks

August 23, 2024

Addressing the Full Stack of AI Concerns: Responsible AI, Trustworthy AI, Secure AI and Safe AI Explained

Our Latest Articles

Offensive AI

Marin IvezicOctober 3, 2026

AI-Enabled Security Testing: Count What Gets Verified and Fixed

AI tools now find real vulnerabilities in quantity, and the bottleneck has moved to verifying and fixing them. What full…
Read More »
Agentic AI Security

Marin IvezicSeptember 16, 2026

What a Security Team Can Safely Delegate to AI Agents

Attackers now write malware for the AI that triages it. Which SOC work can safely go to an AI agent,…
Read More »
AI Safety and Alignment

Marin IvezicSeptember 12, 2026

How a Misaligned AI Would Actually Take Power: The Attacker’s View

The people who build frontier AI ask how a model could ever take power. The July 2026 intrusions answered the…
Read More »
AI Perspectives

Marin IvezicSeptember 7, 2026

No, GPT-6 Astra is not AGI. Nvidia’s CEO is wrong.

Astra fails five of the six AGI definitions that have any technical content behind them. OpenAI never formally declared AGI,…
Read More »
AI Geopolitics

Marin IvezicSeptember 6, 2026

Reading Superpowers and AGI: Bombing Data Centres Is an Old Idea, and It Is Not Disarmament

A report on AGI and US-China competition spent last week being reported as a proposal to bomb Chinese data centres.…
Read More »
AI Privacy

Marin IvezicSeptember 6, 2026

Federated Learning Privacy Depends on What the Server Is Allowed to Send

Federated learning keeps raw data on the device, and the security question that decides your actual risk is not whether…
Read More »
AI Security

Marin IvezicSeptember 6, 2026

AI Model Security: How It Differs from Traditional Cybersecurity, and Where It Doesn’t

For most organisations, AI security is still conventional security applied to an unfamiliar stack. Where AI does add new failure…
Read More »
AI Security

Marin IvezicSeptember 6, 2026

Adversarial Training: What It Buys, What It Costs, and Where It Stops Working

Adversarial training is the one defence against adversarial examples that keeps surviving adaptive attack. It also costs an order of…
Read More »
AI Security

Marin IvezicSeptember 6, 2026

Robust Optimization Is the Only Defence That Held, and Only Inside Its Own Threat Model

Adversarial training as robust optimization is the only defence in fifteen years of adversarial machine learning that has survived attacks…
Read More »

Previous Next

Marin Ivezic

In the early 2000s, running emerging-technology risk labs at CyberAgency, a defence client asked my team to break the AI systems they planned to put into weapons. We did. That is where my work on AI security started, two decades before the current wave of attention. I kept at it through risk labs at IBM, Accenture, PwC and KPMG. In 2016 I co-wrote a book on AI and leadership. My commercial work today is quantum, at Applied Quantum, which is why this site sells nothing.

Luka Ivezic

Luka Ivezic co-wrote The Future of Leadership in the Age of AI with Marin in 2016, and co-authored much of the early writing on this site. He is Practice Lead, Regulations & Emerging Technologies at the Information Security Forum, where he covers EU regulation and the security of AI, OT and IoT. He was previously a cybersecurity consultant at PwC and Deloitte. He holds a Master’s in International Conflict Studies from King’s College London, where his research examined the security implications of AI.

Most Viewed Articles This Week

September 6, 2026

AI Security

AI Security

Marin IvezicSeptember 6, 2026

AI Model Security: How It Differs from Traditional Cybersecurity, and Where It Doesn’t

For most organisations, AI security is still conventional security applied to an unfamiliar stack. Where AI does add new failure modes, hardening the model will not reliably remove them. What changes, what doesn't, and what to do on Monday.
Read More »
AI Security

Marin IvezicSeptember 6, 2026

Adversarial Training: What It Buys, What It Costs, and Where It Stops Working

Adversarial training is the one defence against adversarial examples that keeps surviving adaptive attack. It also costs an order of magnitude in compute, several points of clean accuracy, and stops working once you cannot write the threat model down.
Read More »
AI Security

Marin IvezicSeptember 6, 2026

Robust Optimization Is the Only Defence That Held, and Only Inside Its Own Threat Model

Adversarial training as robust optimization is the only defence in fifteen years of adversarial machine learning that has survived attacks built to break it. What it costs, where it stops, and what to ask a vendor.
Read More »
AI Security

Marin IvezicSeptember 5, 2026

AI Deployment Security: Build the Boundary Outside the Model

A model in production will misread a document, accept a malicious premise or propose the wrong action. Securing the deployment means building the boundary outside the model, so a fooled model cannot exceed the consequences the organisation authorised.
Read More »
AI Security

Marin IvezicSeptember 5, 2026

White-Box vs. Black-Box Attacks: What Access Actually Buys

The attacker's access class used to predict how strong an attack would be. For LLM systems it no longer does on its own, and the two labels have started hiding the question that matters: what did the attacker actually…
Read More »
AI Security

Marin IvezicSeptember 5, 2026

Article 15 Requires Robustness Nobody Can Measure

Article 15(5) runs to three sentences and most summaries quote only the first. The other two set a proportionality standard nobody can measure, because no benchmark, no harmonised standard and no threat-model-independent robustness metric exists.
Read More »

Previous Next

Agentic and Offensive AI

Offensive AI

Marin IvezicOctober 3, 2026

AI-Enabled Security Testing: Count What Gets Verified and Fixed

AI tools now find real vulnerabilities in quantity, and the bottleneck has moved to verifying and fixing them. What full automation should mean, how to measure AI-enabled security testing, and how to run it safely.
Read More »
Agentic AI Security

Marin IvezicSeptember 16, 2026

What a Security Team Can Safely Delegate to AI Agents

Attackers now write malware for the AI that triages it. Which SOC work can safely go to an AI agent, how to scope its identity and actions, and what an analyst's sign-off is actually worth.
Read More »
Agentic AI Security

Marin IvezicSeptember 5, 2026

The AI Act Now Recognises Agents. Its Security Rules Still Miss Them.

The Commission's AI Act Service Desk says agents are covered by the existing definitions and calls its own considerations preliminary. All that coverage sits at the model layer, and Article 15 names none of the ways agents fail.
Read More »
Agentic AI Security

Marin IvezicAugust 19, 2026

The Techniques Were Familiar. The Attacker Wasn’t.

Roughly 1,200 agents found each other on an unsanctioned message board and 700 of them attacked Hugging Face. Every exploit in the chain was ordinary. The controls that would have caught it existed and were not running.
Read More »
Offensive AI

Marin IvezicAugust 10, 2026

A Guardrail Checks a Request. An Attacker Runs an Operation.

Three campaigns since late 2025 have got AI agents to run offensive work. None needed an adversarial prompt. Two lied about authorisation and decomposed the operation, and the third simply chose a model with fewer controls to begin with.
Read More »
Offensive AI

Marin IvezicAugust 4, 2026

Your Incident Response Plan Assumes a Model That Will Answer

Hugging Face's responders were refused by commercial models when they tried to analyse their own attack logs, and finished the forensics on open weights they ran themselves. The refusal rate has been measured.
Read More »

Previous Next

Governance, Policy and Geopolitics

AI Geopolitics

Marin IvezicSeptember 6, 2026

Reading Superpowers and AGI: Bombing Data Centres Is an Old Idea, and It Is Not Disarmament

A report on AGI and US-China competition spent last week being reported as a proposal to bomb Chinese data centres. It is not one. The underlying idea is five years old and cannot achieve what its advocates claim.
Read More »
AI Governance and Policy

Marin IvezicSeptember 5, 2026

One AI Incident, Four Reporting Regimes, and the Carve-Outs That Decide Which Apply

Cyber Resilience Act reporting starts 11 September 2026, joining three other European regimes. The AI Act already limits its own duty where an equivalent one exists, so the runbook question is which regimes the Act pre-empts.
Read More »
AI Governance and Policy

Marin IvezicSeptember 5, 2026

The AI Act’s GPAI Security Chapter Is a Weight Security Mandate

Article 55(1)(d) requires an adequate level of cybersecurity for a frontier model and its physical infrastructure, and the Commission-endorsed Code turns that into weight-level controls. In August 2026 the AI Office started asking for the evidence.
Read More »
AI Governance and Policy

Marin IvezicSeptember 5, 2026

The EU AI Act for Security Teams

The first enforcement step under the EU AI Act was a demand for security evidence. What the Digital Omnibus deferred to 2027, what became enforceable in August 2026, and what a security team has to build before December.
Read More »
AI Geopolitics

Marin IvezicSeptember 1, 2026

The Stack Was Already There. The Controls Gave It Customers.

Huawei shipped Ascend, CANN and MindSpore in 2019, three years before the first export controls. What the controls supplied was not the stack but the reason to adopt it, and that is the part that does not unwind.
Read More »
AI Governance and Policy

Marin IvezicAugust 25, 2026

Measuring AI in the SOC: Outcomes, Baselines and the MTTR Trap

AI can make a security team faster while its backlog grows. Measuring an AI workflow properly means pairing every speed gain with a quality counter-metric and a credible baseline, and checking what it catches, misses and costs.
Read More »

Previous Next

Privacy and Disinformation

AI Privacy

Marin IvezicSeptember 6, 2026

Federated Learning Privacy Depends on What the Server Is Allowed to Send

Federated learning keeps raw data on the device, and the security question that decides your actual risk is not whether gradients leak but whether the party running the aggregation server is honest, and whether your clients could tell.
Read More »
AI Disinformation

Marin IvezicSeptember 5, 2026

The AI Act’s Transparency Code Relies on Watermarks That Break

Article 50 requires marking that is effective and robust as far as technically feasible, and prescribes no technique. The Code selects watermarking and provenance metadata. Published attacks remove both and forge the second.
Read More »
AI Privacy

Marin IvezicAugust 27, 2026

Secure Multi-Party Computation Hides the Inputs, Not the Answer

Secure multi-party computation protects the inputs to a computation and reveals the output exactly as computed. In machine learning the output is a model or a prediction, and both leak. What MPC covers, what its benchmarks assume, and what to ask.
Read More »
AI Privacy

Marin Ivezic and Luka IvezicJuly 21, 2023

Homomorphic Encryption for ML: What the Overhead Buys

Homomorphic encryption lets an untrusted server compute on data it cannot read. The overhead is severe enough that the set of machine learning workloads where that trade is correct is small, specific and worth naming precisely.
Read More »
AI Disinformation

Marin Ivezic and Luka IvezicDecember 6, 2022

Introduction to AI-Enabled Disinformation

In recent years, the rise of artificial intelligence (AI) has revolutionized many sectors, bringing about significant advancements in various fields. However, one area where AI has presented a dual-edged sword is in information operations, specifically in the propagation of disinformation. The advent of generative AI, particularly with sophisticated models capable of creating highly realistic text, images, audio, and video, has…
Read More »
AI Privacy

Marin Ivezic and Luka IvezicNovember 11, 2022

Dynamic Data Masking Protects the View, Not the Model

Masking rewrites what a query returns and leaves the stored data alone. Whoever builds your training set either reads through the mask or under it, and neither outcome gives the resulting model any privacy property at all.
Read More »

Previous Next

Infrastructure and Cyber-Kinetic AI

AI Infrastructure and Compute

Marin IvezicSeptember 1, 2026

Your Multi-Region Architecture Assumes the Weather

Cloud resilience architecture is built against hazards: storms, fibre cuts, bad deploys. On 1 March 2026 one AWS region absorbed a drone strike as designed, then failed when a second zone went down later the same day.
Read More »
AI Infrastructure and Compute

Marin IvezicAugust 31, 2026

What Still Keeps Frontier Training Concentrated

Every argument about attacking AI compute assumes frontier training stays physically concentrated. That is an engineering trade-off rather than a law, hyperscalers already breach it routinely, and the question is how much further it stretches.
Read More »
Cyber-Kinetic AI

Marin IvezicJuly 23, 2026

The Agent That Reaches Your Control Network May Already Work for You

OT threat models already cover insiders and human error. Two 2026 evaluation incidents added a different mechanism: an agent given a task it could not complete widened the problem boundary into the systems around it, with nobody directing the deviation.
Read More »
Cyber-Kinetic AI

Marin IvezicApril 7, 2024

The Dual Risks of AI Autonomous Robots: Uncontrollable AI Meets Cyber-Kinetic Risks

The automotive industry has revolutionized manufacturing twice. The first time was in 1913 when Henry Ford introduced a moving assembly line at his Highland Park plant in Michigan. The innovation changed the production process forever, dramatically increasing efficiency, reducing the time it took to build a car, and significantly lowering the cost of the Model T, thereby kickstarting the world’s…
Read More »

Safety, Alignment and Perspectives

AI Safety and Alignment

Marin IvezicSeptember 12, 2026

How a Misaligned AI Would Actually Take Power: The Attacker’s View

The people who build frontier AI ask how a model could ever take power. The July 2026 intrusions answered the first step and half of the second. The rest run through controls organisations already own and already fail at.
Read More »
AI Perspectives

Marin IvezicSeptember 7, 2026

No, GPT-6 Astra is not AGI. Nvidia’s CEO is wrong.

Astra fails five of the six AGI definitions that have any technical content behind them. OpenAI never formally declared AGI, and its chip supplier did. One benchmark with two answers 37 points apart, and what the label is actually worth.
Read More »
AI Safety and Alignment

Marin IvezicAugust 15, 2026

Three Capability Scores for One Model, and METR Disowned All Three

METR produced three capability estimates for one model, ranging from 11 hours to over 270, and said none of them was a robust measurement. The UK AI Security Institute found every frontier model it tested attempted to cheat.
Read More »
AI Safety and Alignment

Marin IvezicJanuary 1, 2024

Marin’s Statement on AI Risk

The rapid development of AI brings both extraordinary potential and unprecedented risks. AI systems are increasingly demonstrating emergent behaviors, and in some cases, are even capable of self-improvement. This advancement, while remarkable, raises critical questions about our ability to control and understand these systems fully.
Read More »
AI Safety and Alignment

Marin Ivezic and Luka IvezicJune 29, 2023

The AI Alignment Problem

The AI alignment problem sits at the core of all future predictions of AI’s safety. It describes the complex challenge of ensuring AI systems act in ways that are beneficial and not harmful to humans, aligning AI goals and decision-making processes with those of humans, no matter how sophisticated or powerful the AI system becomes. Our trust in the future…
Read More »
AI Perspectives

Marin Ivezic and Luka IvezicMay 23, 2023

A (Very) Brief History of AI

As early as the mid-19th century, Charles Babbage and Ada Lovelace created the Analytical Engine, a mechanical general-purpose computer. Lovelace is often credited with the idea of a machine that could manipulate symbols in accordance with rules and that it might act upon other than just numbers, touching upon concepts central to AI.
Read More »

Previous Next