Zbigniew Zawadzki

2025-01

AI governance security checklist — developed the security section of the AI governance framework (from Marek Wisniewski's governance initiative). Defined mandatory security review steps for any new AI model deployment.

Challenge: The security checklist needed to be lightweight enough for adoption by engineering teams without security backgrounds. Initial draft was 28 items — reduced to 8 mandatory items with 15 conditional items based on deployment risk tier, following the same principle as the broader governance framework.

Learned: AI security checklists must be tiered by deployment risk. A single long checklist is ignored by low-risk deployments and provides false assurance when applied uniformly. A short mandatory base checklist with conditional extensions for high-risk deployments achieves better compliance than a one-size-fits-all approach.

2024-06

AI threat model for the production ML platform — performed STRIDE threat modeling for the full AI inference pipeline (user request → API gateway → model service → response). Identified 14 threats, 3 rated High, and implemented mitigations.

Challenge: The model serving API had no rate limiting — a high-priority finding as it enabled both cost-based denial of service (excessive inference spend) and data extraction via repeated query probing. Implemented token-bucket rate limiting per user and per API key at the API gateway layer.

Learned: AI inference API rate limiting is both a cost control and a security control. Without rate limiting, adversarial probing through repeated queries can extract training data or model decision boundaries — implement rate limiting at the API gateway before any production exposure.

2023-11

RBAC design for multi-tenant RAG platform — designed role and permission model for 5 user roles (Administrator, Engineer, Reviewer, Read-Only, API Service) with document classification-based access control integrated with Azure AD groups.

Challenge: Qdrant payload filtering for RBAC required that user security clearance metadata is embedded in each vector's payload at ingestion time. A late-discovered requirement that some documents have complex classification trees (up to 4 classification levels) required schema extension that triggered re-ingestion of 40,000 documents.

Learned: Document security classification schema must be finalized before any production ingestion. Late classification schema changes force complete re-ingestion — design the most complex plausible classification schema upfront and validate with all stakeholders before the first production document is ingested.

2023-05

LLM security assessment for the production RAG system — evaluated for prompt injection, data leakage across tenants, system prompt extraction, and jailbreak resistance. Used Garak automated red-teaming and manual adversarial prompting.

Challenge: Indirect prompt injection via retrieved document content was the highest-risk finding — a malicious document in the knowledge base could inject instructions into the LLM response and manipulate the system's behavior for subsequent queries from other users. Required implementing input sanitization on retrieved chunks before injection into the prompt.

Learned: Indirect prompt injection via RAG retrieved content is a critical attack vector that is often overlooked. Sanitizing the user query is insufficient — every retrieved document chunk must also be scanned for injection patterns before inclusion in the LLM prompt context.