S0088RS3-T11-S0088-Z · Full risk code

Unencrypted Model Weights Leaked

模型權重未加密外洩

Deployment
Risk Description

When an organization's model weights become publicly accessible due to a storage permission misconfiguration; due to unmitigated control gaps, the exposure is discovered only after several months, by which time the weights have been downloaded by multiple parties, with no possibility of recovery or determining where they went, triggering compliance exposure and operational reputational costs.

Framework Mappings

OWASP Top 10 for LLMLLM03
MITRE ATLASAML.T0024
NIST AI 100-2Privacy—Model Extraction
ISO/IEC 5338部署
MIT AI Risk RepositoryDomain 6

Risk Treatment & Implementation Guidance

Encrypt model weights at rest with strict access control under least privilege; Periodically audit storage permissions, detecting publicly accessible misconfigurations; Log and alert on weight access, reporting anomalous downloads