❗ CTA: Input into the Project Charter

[shsingh]

Hi all,

We are looking to have people read through the current charter.

And please provide your feedback, and perhaps questions in this discussion thread.

--

1. Does the charter and its scope define what you would want to consume in a "Machine Learning Security Top 10"?
2. Is the scope too narrow? Too broad?
3. What things would you add?
4. What is missing that needs to be highlighted?

--

Thank you for taking the time to contribute!

[robvanderveer]

We have the combination of 1) OWASP AI guide, 2) the ML top 10, and 3) the LLM top 10 as awareness documents from OWASP, and it's essential that we find a way how to make these projects complement each other. We need to avoid double work and prevent inconsistencies.

Some history:
In February 2023 the ML top 10 project had been not living for a while. I tried to reach out to the people involved without success. So I approached OWASP leadership and proposed to start an initiative to create awareness for AI security, which turned into the OWASP guide for AI security & privacy at https://owasp.org/www-project-ai-security-and-privacy-guide/
Then I did get in touch with the people behind the Top 10, and now we are in the situation that this is revamping, which I have advocated for.

Therefore is important that the AI guide and the Top 10 and the LLM top 10 have charters that complement each other: the AI guide to provide a high level overview of the complete security/privacy picture including fairness, transparency etc, discusses how to deal with AI security in the organisation, and refers for insight in the risks to the Top 10 project to go deeper into the threats and especially the countermeasures.

In order to achieve this, the purpose of the top 10 can be changed to 'The primary aim is to deliver an overview of the top 10 security issues of machine learning systems'.
The term 'awareness document' which is now in the charter may be interpreted as a discussion document like the AI guide, which is scope creep that we want to prevent.
This way, the ML top 10 is also more in line with the main OWASP top 10.

[shsingh]

Hi @robvanderveer

re: the history, it is disheartening that you were not able to help drive things earlier this year. However, this project is fortunate that in that absence you were able to initiate the AI Security and Privacy and we also now have the fantastic work that @virtualsteve-star
has helped steer with the LLM Top 10.

Thank you for all your efforts in the backend with administration to help bootstrap this project so that we have a forum to discuss all things related to ML Security.

It is unequivocally the intent of this project to ensure the projects not only compliment each other, but also enable those who have contributed previously to be involved in the MLSEC TOP 10 as well.

To that end, the charter seeks to ensure that we do ensure there is clarity and no inconsistencies as you mention. The suggestion to amend the charter to remove ‘awareness document’ does work towards showing how the projects compliment each other as you noted. (Side note: we thought it may be presumptuous to do that from the beginning without having discussions with the leaders of those projects first - which is what is happening now)

[shsingh]

charter modified to remove 'security awareness': #53 and #54