⚡ Quick Summary
Published by the European Union Agency for Cybersecurity (ENISA), this report identifies cybersecurity threats, vulnerabilities and controls relevant to machine learning (ML) algorithms. It is intended to help project teams assess ML-specific risks and select security measures, while stressing that ML applications also need conventional cybersecurity controls. Its methodology combines an extensive literature review—covering more than 200 documents, around 100 of them security-related—with interviews and review by ENISA’s Ad-Hoc Working Group on Artificial Intelligence Cybersecurity.
The report develops a non-exhaustive taxonomy of 40 commonly used algorithms, organised around main domain, data type and learning paradigm, with explainability and accuracy included as additional parameters. It then maps threats such as evasion, oracle attacks, poisoning, model or data disclosure, component compromise and denial of service to lifecycle stages and associated vulnerabilities. A set of 37 controls is grouped as organisational and policy, technical, or specific to ML. The central conclusion is that there is no single set of controls suitable for every ML deployment: controls should be selected through targeted, context-specific risk assessments and balanced against performance considerations.
🧩 What’s Covered
The report proceeds from its research approach to a taxonomy, threat analysis and control catalogue:
- Objectives, methodology and audiences: Explains the three-stage approach: developing an ML taxonomy, identifying ML threats and vulnerabilities, and identifying controls. The intended users include public and governmental bodies, industry and SMEs, AI and cybersecurity specialists, researchers, and standardisation bodies.
- ML taxonomy: Categorises 40 algorithms by the main domains of computer vision, NLP and speech processing, and classic data science. It relates these domains to image, video, text, time-series and structured data, and distinguishes supervised, unsupervised and reinforcement learning.
- Explainability and lifecycle: Defines global and local explainability, discusses probability scores described as accuracy levels, and presents a lifecycle from data collection and cleaning through preprocessing, design, training, testing, optimisation, evaluation, deployment, and monitoring and inference.
- Threats and vulnerabilities: Identifies six high-level threats and seven sub-threats. Tables define evasion, oracle, poisoning and label modification attacks, disclosures, component compromise, failures, human error, sponge-example denial of service, and missed incident reporting; they identify the lifecycle stages where these can occur.
- Security controls: Lists 37 controls across organisational, technical and ML-specific categories. Examples include least-privilege RBAC, documentation, risk analysis, data and component checks, monitoring indicators, adversarial training, differential privacy, federated learning, output-information reduction and poisoning checks.
- Mappings, implementation examples and conclusion: Annexes map controls to individual vulnerabilities and threats, give implementation examples from ISO 27001/2, NIST 800-53 and the literature, and provide the taxonomy and reference base. The conclusion calls for active monitoring of new attacks and defences, standardised benchmarks, and attention to security-performance trade-offs.
💡 Why it matters?
The report provides a structured route from ML design and deployment choices to threats, vulnerabilities and candidate controls. This can support risk analysis across the lifecycle rather than treating model training as the sole security concern. It also makes explicit that model code, data, outputs, open-source components, test environments and third parties require attention alongside ML-specific defences. For governance and assurance work, the control mappings connect issues such as access management, documentation, data security, incident response, explainability and privacy with particular ML attack scenarios. The report further situates conventional controls from ISO 27001/2 and NIST 800-53 alongside techniques drawn from ML-security research.
❓ What’s Missing
The taxonomy is explicitly non-exhaustive and is designed to support this report’s security analysis rather than comprehensively describe ML. It covers 40 commonly used algorithms, while noting that data creation and data analysis—such as analysis for personal data or bias—were condensed or treated as external to the lifecycle. Threats against supporting infrastructures are not analysed. The report also says that ML-specific controls have not generally been evaluated in a standardised way and calls for comparable benchmarks. Operational examples are uneven: it notes that the prevalence of research on supervised learning produces more implementation examples for that learning paradigm. Finally, it does not prescribe a universal control set, because applicability depends on the specific use case, data, deployment and threat level.
👥 Best For
Security and AI governance teams conducting risk analyses for ML applications; data scientists and developers integrating security and privacy considerations into model lifecycles; and security operations, compliance and audit staff mapping ML-specific controls alongside established access, vulnerability-management, incident-response and resilience processes. It is also suited to public-sector, industry and standardisation audiences identifying threat-control relationships.
📄 Source Details
Securing Machine Learning Algorithms was published in December 2021 by the European Union Agency for Cybersecurity (ENISA). It names Apostolos Malatras, Ioannis Agrafiotis and Monika Adamczyk as editors. This 70-page English report carries ISBN 978-92-9204-543-2, DOI 10.2824/874249, and catalogue number TP-06-21-153-EN-N.
