AI Security Engineering (Dan Borges and David Campbell)（Z-Library）

# AI Security Engineering — Reading Guide ## 【One-Line Pitch】 A practical security engineering handbook for teams building production AI systems—especially retrieval-augmented pipelines, persistent memory, and agentic architectures—showing how to apply classic security principles to the new, nondeterministic attack surface of LLMs. Read this if you're deploying AI beyond chatbots and need to think like an adversary before attackers do. ## 【Book Arc】 - **Opening (~0%–10%)**: Establishes the core thesis—AI systems have moved from generating text to taking actions in production, creating a fundamentally new control surface. The authors frame the book around real failure modes: prompt injection, poisoned retrieval, and authority creep in agents. - **Early (~19%–33%)**: Builds the conceptual foundation by mapping AI security problems onto traditional security principles. Covers first-principles reasoning, untrusted input as the root of most AI vulnerabilities, and why classic controls like input validation and sanitization remain relevant for LLM-based systems. - **Middle (~38%–52%)**: Introduces the Behaviour, Identity, and Control (BIC) framework, diving into authentication vs. authorization, trust boundaries, and access control as the backbone of securing agentic systems. Discusses "control decay"—how security controls lose effectiveness over time as technologies evolve. - **Middle (~52%–62%)**: Explores defense in depth as the strategic response to inevitable control failure. Draws on military and infosec history (Schneier, OWASP) to argue for overlapping, independent layers of security rather than single-point solutions, and connects this to kill-chain thinking from adversarial tradecraft. ## 【Key Takeaways】 - **AI systems are a new attack surface, not just a new technology** (Opening): Because LLMs reason, adapt, and act on untrusted input, traditional deterministic security models break down. The book's premise is that you must design for failure, not assume the model will behave. - **Map new AI vulnerabilities to known security categories** (Early): Prompt injection is fundamentally an untrusted input problem, similar to SQL injection or XSS. Reframing AI failures as classic vulnerability classes lets you reuse decades of proven mitigation strategies. - **Treat all external input as potentially malicious until validated** (Early): This principle, borrowed from web security, is the single most important mental model for AI systems—anywhere a user or agent can send input is an attack surface. Input sanitization and output validation remain essential controls. - **Access control is the #1 issue for agentic AI** (Middle): The BIC framework (Behaviour, Identity, Control) emphasizes that verified identity and explicit authorization must precede any action. The authors note access control remains the top OWASP issue even in 2025, and it's especially critical when agents accumulate authority. - **Map trust boundaries before designing controls** (Middle): Every point where identity, permissions, or security assumptions change is a boundary requiring explicit authority checks. Implementing these checks ubiquitously through common middleware is a practical pattern for consistent enforcement. - **Security controls decay—plan for it** (Middle): Like "bit rot," security measures become less effective as surrounding technologies evolve. The authors argue that continuous testing, updating, and challenging of controls is mandatory, not optional, especially with AI-assisted exploit development accelerating. - **Defense in depth is the antidote to control failure** (Middle): Overlapping, independent controls ensure that failure of one layer doesn't mean total compromise. This isn't overengineering—it's a systems engineering approach to inevitable human and technical error. ## 【Reading Tips】 - **Skim the front matter** (~0%–10%): The preface and conventions are standard O'Reilly boilerplate. Jump straight to the security principles discussion around the 19% mark. - **Deep-read the principles chapters** (~19%–52%): This is the conceptual core. The BIC framework and trust boundary mapping are the most actionable mental models—take time to internalize how they apply to your own systems. - **Watch for the "reframing" technique**: The authors repeatedly show how AI vulnerabilities map to classic categories (injection, access control, etc.). Pay attention to these mappings—they're the book's real value for practitioners. - **Note the OWASP references**: The book engages with OWASP Top 10 for both general web and agentic applications. If you're familiar with OWASP, use it as an anchor; if not, consider skimming the OWASP Top 10 for Agentic Applications in parallel. - **Excerpts don't cover later chapters**: The sample material ends around 62% of the book. Later content presumably covers specific attack techniques, case studies, and implementation patterns—if those are your priority, check the table of contents or a fuller edition. ## 【Coverage Limits】 This guide is based on excerpts covering roughly the first 60% of the book, focusing on security principles and frameworks. Specific attack demonstrations, detailed case studies, and hands-on implementation guidance from later chapters are not covered here. ##