AI Model Attack Surface Calculator
Estimates the overall attack surface score of an AI/ML model deployment using exposure, model complexity, data sensitivity, access controls, and adversarial risk factors. Higher scores indicate a larger attack surface requiring more rigorous security controls.
Formula
Exposure Factor (EF) = Deployment Type Score × Output Exposure Score
Complexity Factor (CF) = Model Complexity Score × Data Sensitivity Score
Mitigation Factor (MF) = (Input Validation + Access Control + Monitoring) ÷ 30
Supply Chain Risk (SCR) = Supply Chain Score ÷ 10
Raw Score = (EF × CF × (1 − MF + 0.1)) + (SCR × 10)
Attack Surface Score (0–100) = ((Raw Score − 1.1) ÷ (91.0 − 1.1)) × 100
The mitigation term (1 − MF + 0.1) ensures a minimum residual risk of 0.1 even with perfect mitigations,
reflecting that no system is entirely risk-free. The theoretical maximum raw score is 91.0
(worst-case all factors) and minimum is 1.1 (best-case all factors).
Assumptions & References
- Deployment type and output exposure are treated as multiplicative because a highly exposed model that also leaks internal representations compounds risk non-linearly.
- Model complexity and data sensitivity are multiplied because a complex model trained on sensitive data creates greater membership inference and model inversion risk than either factor alone.
- Mitigation scores (input validation, access control, monitoring) are averaged and inverted so that stronger defences reduce — but never eliminate — the attack surface.
- Supply chain risk is additive (not multiplicative) to reflect that it is a partially independent threat vector (e.g., poisoned dependencies) rather than purely a function of model exposure.
- Score bands align broadly with CVSS v3.1 severity thresholds (0–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical), scaled to 0–100.
- References: OWASP ML Security Top 10 (2023); MITRE ATLAS (Adversarial Threat Landscape for AI Systems); NIST AI RMF (2023); Papernot et al., "The Limitations of Deep Learning in Adversarial Settings" (IEEE EuroS&P 2016); Shokri et al., "Membership Inference Attacks Against Machine Learning Models" (IEEE S&P 2017).
- This calculator provides a relative risk indicator for comparative and planning purposes. It does not replace a formal penetration test or threat modelling exercise.