18. Glossary

One-line definitions of the terms used throughout the guide, alphabetical. The part where each is explained in depth is in brackets.

Term	Meaning
Adaptive attack	An attack designed with full knowledge of the specific defense it targets [9, 14]
Adversarial example	An input changed slightly, often imperceptibly, to make a model err [9]
AEAD	Authenticated encryption: confidentiality and integrity together, e.g. AES-GCM [4]
AIBOM	AI bill of materials: an inventory of models, datasets, versions and sources [12]
Attack success rate (ASR)	Fraction of attack attempts that achieve the attacker’s goal [14]
Attack surface	Every point where an attacker can interact with a system [1]
Authentication / authorization	Proving who you are / deciding what you may do [5]
Backdoor (trojan)	Hidden model behaviour triggered by a secret input pattern [9]
Blast radius	How much damage follows if one component is fully compromised [1]
Broken object-level authorization (IDOR)	Access granted to an object without checking it belongs to the requester [5, 6]
Canary token	A unique planted string whose appearance elsewhere reveals a leak [14]
CIA triad	Confidentiality, integrity, availability [1]
Confidential computing / TEE	Hardware-isolated execution that shields data in use, with attestation [4]
Confused deputy	A program tricked into using its authority on behalf of someone without it [5, 11]
Content Security Policy (CSP)	Browser rules limiting which scripts and resources a page may load [6]
CVE / CVSS	Public vulnerability identifier / generic severity score from 0 to 10 [6, 16]
Data poisoning	Corrupting training data to change model behaviour [9]
Defense in depth	Layered controls so a single failure is not fatal [1]
Differential privacy (ε)	Provable limit on what an output reveals about any one individual; ε is the budget [9]
DPIA	Data protection impact assessment, required under GDPR for high-risk processing [13]
Egress filtering	Controlling which outbound connections a workload may make [3]
Evasion attack	Fooling a deployed model at inference time [9]
Excessive agency	An AI system with more tools, permissions or autonomy than its task needs [10, 11]
Exfiltration	Moving data out of a system to an attacker [10, 11]
Forward secrecy	Past sessions stay safe even if a long-term key is later stolen [3]
Guardrail	A control around a model: a classifier, a filter or a policy [10, 14]
Hidden context exposure	Extraction of system prompts, tool schemas or other non-user context [10]
Indirect prompt injection	Instructions hidden in content a model processes on a user’s behalf [10]
Jailbreak	Getting a model to violate its own safety policy [10]
Kerckhoffs’s principle	Assume the attacker knows the design; only keys are secret [1]
Least privilege / least agency	Minimum permissions / minimum autonomy for the task [1, 11]
Lethal trifecta	Private data + untrusted content + external communication in one agent [11]
MCP	Model Context Protocol, a standard for connecting agents to tools and data [11]
Membership inference	Determining whether a record was in a model’s training set [9]
MITRE ATT&CK / ATLAS	Catalogues of real attacker tactics and techniques; ATLAS covers AI [7, 8]
Model extraction	Copying a model’s behaviour through queries [9]
Model inversion	Reconstructing sensitive training features or inputs from a model [9]
mTLS	Mutual TLS, where client and server both present certificates [3]
OAuth 2.0 / OIDC	Delegated authorization with scoped tokens / identity layer on top [5]
Passkey / WebAuthn	Phishing-resistant login bound cryptographically to the real website [5]
Pickle	Python serialization format that can execute code when loaded [2, 12]
Provenance	Verifiable record of where an artifact came from and how it was built [7, 12]
Red teaming	Adversarial testing to find failures before attackers do [14]
Rug pull	A tool or dependency changing after it was approved [11]
safetensors	A data-only model weight format with no code execution on load [12]
SBOM	Software bill of materials: an inventory of components [7]
SLSA	Framework of build-integrity levels centred on signed provenance [7]
SSRF	Server-side request forgery: making a server fetch an attacker-chosen URL [6]
STRIDE	Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege [1]
Supply chain attack	Compromise through a dependency, build system or third-party artifact [7, 12]
Taint tracking	Following untrusted data through a system and restricting where it may flow [11]
Threat model	A structured description of assets, adversaries, entry points and mitigations [1, 15]
TOCTOU	Time-of-check to time-of-use: something changes between being checked and used [2]
Trust boundary	A line where data or control passes between different trust levels [1]
Trusted computing base (TCB)	The components whose correctness your security depends on [1]
XSS	Cross-site scripting: attacker script running in your site’s origin [6]
Zero trust	No implicit trust from network location; every request is verified [1, 3]