Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile
Section 4.1.a of Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and > 2. Using the SSDF Community Profile

2. Using the SSDF Community Profile

AI model producers, AI system producers, AI system acquirers, and others can use the SSDF to
foster their communications regarding secure AI model development throughout the software
development life cycle.2 Following SSDF practices should help AI model producers reduce the
number of vulnerabilities in their AI models, reduce the potential impacts of the exploitation of
undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to
prevent recurrences. AI system producers can use the SSDF's common vocabulary when
communicating with AI model producers regarding their security practices for AI model
development and when integrating AI models into the software they are developing. AI system
acquirers can also use SSDF terms to better communicate their cybersecurity requirements and
needs to AI model producers and AI system producers, such as during acquisition processes.
The SSDF Community Profile is not a checklist to follow, but rather a starting point for planning
and implementing a risk-based approach to adopting secure software development practices
involving AI models. The contents of the Profile are meant to be adapted and customized, as
not all practices and tasks are applicable to all use cases. Organizations should adopt a risk-
based approach to determine what practices and tasks are relevant, appropriate, and effective
to mitigate the threats to software development practices from the organization's perspective
as an AI model producer, AI system producer, or AI system acquirer. Factors such as risk, cost,
feasibility, and applicability should be considered when deciding which practices and tasks to
use and how much time and resources to devote to each one. Cost models may need to be
updated to effectively consider the costs inherent to AI model development. A risk-based
approach to secure software development may change over time as an organization responds
to new or elevated capabilities and risks associated with an AI model or system.
Generative AI and dual-use foundation models present additional challenges in tracking model
versioning and lineage. Source code for defining the model architecture and building model
binaries is amenable to secure software engineering practices for versioning, lineage, and
reproducibility. However, the final model weights are defined only after the model is trained
and fine-tuned; this is where limitations in tracking all aspects of collection, processing, and
training arise. Organizations should follow secure software development practices for the parts
of a model that can be covered fully and strive to introduce secure practices to the extent
possible for the stages and corresponding artifacts where obtaining such security guarantees is
hard to achieve. Organizations should document the parts and artifacts that are not covered by
the secure software development practices.
The Profile's practices, tasks, recommendations, and considerations can be integrated into
machine learning operations (MLOps) along with other software assets within a continuous
integration/continuous delivery (CI/CD) pipeline.
The responsibility for implementing SSDF practices in the Profile may be shared among multiple
organizations. For example, an AI model could be produced by one organization and executed
within an AI system hosted by a second organization, which is then used by other organizations.
2 For consistency with SSDF 1.1, this document uses a general software development life cycle. Organizations using this document are
encouraged to adapt it to any machine learning-specific life cycle they are using.
In these situations, there is likely a shared responsibility model involving the AI model producer,
AI system producer, and AI system acquirer. An AI system acquirer can establish an agreement
with an AI system producer and/or AI model producer that specifies which party is responsible
for each practice and task and how each party will attest to its conformance with the
agreement.
A limitation of the SSDF and this Profile is that they only address cybersecurity risk
management. There are many other types of risks to AI systems (e.g., data privacy, intellectual
property, and bias) that organizations should manage along with cybersecurity risk as part of a
mature enterprise risk management program. NIST resources on identifying and managing