Description
The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Generative AI/ML models, such as those used for text generation, image synthesis, and other creative tasks, rely on inference parameters that control model behavior, such as temperature, Top P, and Top K. These parameters affect the model's internal decision-making processes, learning rate, and probability distributions. Incorrect settings can lead to unusual behavior such as text "hallucinations," unrealistic images, or failure to converge during training. The impact of such misconfigurations can compromise the integrity of the application. If the results are used in security-critical operations or decisions, then this could violate the intended security policy, i.e., introduce a vulnerability.
Potential Impact
Integrity, Other
Varies by Context, Unexpected State
Other
Alter Execution Logic, Unexpected State, Varies by Context
Demonstrative Examples
{
"model": "my-coding-model",
"context_window": 8192,
"max_output_tokens": 4096,
"temperature", 1.5,
...
}{
...
"temperature", 0.2,
...
}Mitigations & Prevention
Develop and adhere to robust parameter tuning processes that include extensive testing and validation.
Implement feedback mechanisms to continuously assess and adjust model performance.
Provide comprehensive documentation and guidelines for parameter settings to ensure consistent and accurate model behavior.
Detection Methods
- Automated Dynamic Analysis Moderate — Manipulate inference parameters and perform comparative evaluation to assess the impact of selected values. Build a suite of systems using targeted tools that detect problems such as prompt injection (CWE-1427) and other problems. Consider statistical
- Manual Dynamic Analysis Moderate — Manipulate inference parameters and perform comparative evaluation to assess the impact of selected values. Build a suite of systems using targeted tools that detect problems such as prompt injection (CWE-1427) and other problems. Consider statistical
Related Weaknesses
Frequently Asked Questions
What is CWE-1434?
CWE-1434 (Insecure Setting of Generative AI/ML Model Inference Parameters) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
How can CWE-1434 be exploited?
Attackers can exploit CWE-1434 (Insecure Setting of Generative AI/ML Model Inference Parameters) to varies by context, unexpected state. This weakness is typically introduced during the Build and Compilation, Installation, Patching and Maintenance phase of software development.
How do I prevent CWE-1434?
Key mitigations include: Develop and adhere to robust parameter tuning processes that include extensive testing and validation.
What is the severity of CWE-1434?
CWE-1434 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.