The AI Stack Is Broader Than Just the LLM
The large language model is often treated as the center of an AI system. In practice, production AI applications are built from multiple interconnected layers.
A typical AI system looks more like:
Each layer introduces different engineering requirements and security risks. A weakness in one layer can affect the layers above it.
1. Compute
The compute layer provides the infrastructure required to train and operate AI workloads.
It includes:
• GPUs and CPUs
• Memory and storage
• Networking
• Cloud infrastructure
• Containers and orchestration
Compute affects performance, scalability, availability and cost.
Security considerations
• Infrastructure isolation
Separate AI workloads from unrelated systems and environments.
• Access control
Restrict access to GPUs, servers, cloud resources and management interfaces.
• Supply chain security
Assess container images, libraries and infrastructure components before deployment.
2. Models
The model layer includes the AI models used by the system.
This may include:
• Foundation models
• LLMs
• Multimodal models
• Embedding models
• Classification models
• Fine tuned models
Model selection involves more than benchmark performance. Latency, cost, reliability, privacy, deployment requirements and security can all influence the choice.
Security considerations
• Model provenance
Know where a model came from and whether it can be trusted.
• Model integrity
Protect deployed models against unauthorized modification or replacement.
• Model supply chain
Evaluate third party and open source models before incorporating them into production systems.
3. Data
Data is fundamental to AI systems.
It can include:
• Training data
• Fine tuning data
• Enterprise documents
• Databases
• User inputs
• Conversation history
• Telemetry
Data quality and relevance directly influence system performance.
Security considerations
• Data access
AI systems should only access information the user or application is authorized to access.
• Data leakage
Sensitive information can enter prompts, model context or generated responses.
• Data poisoning
Manipulated training, fine tuning or knowledge data can influence AI behavior.
4. Inference
Inference is where a trained model is used to generate predictions or responses.
A simplified architecture is:
Production inference involves latency, scalability, availability, cost and monitoring.
Security considerations
• Authentication and authorization
Only authorized users and applications should be able to invoke models and their capabilities.
• Abuse and resource consumption
Rate limiting and monitoring can help prevent automated abuse and uncontrolled resource consumption.
• Input and output controls
Monitor potentially malicious inputs and sensitive or unsafe outputs.
5. Retrieval Augmented Generation
Retrieval Augmented Generation, or RAG, allows an AI application to retrieve external information and provide it to a model as context.
A simplified RAG pipeline is:
RAG is widely used for enterprise knowledge bases because it allows AI systems to work with information that is not contained in the model’s original training data.
Security considerations
• Access control
Users should only retrieve documents and information they are authorized to access.
• Data poisoning
Malicious or manipulated documents can influence what information is retrieved and provided to the model.
• Context integrity
Retrieved information becomes part of the model’s context, so untrusted content can influence model behavior.
6. Agents
Agents extend AI applications beyond generating responses.
An agent may:
This allows AI systems to perform multi step tasks and potentially operate with limited human intervention.
Security considerations
• Identity and authorization
An agent needs a defined identity and permissions determining what it can access and do.
• Least privilege
Agents should receive only the permissions required for their tasks.
• Action control
High impact actions should have appropriate restrictions or human approval.
The security challenge increases significantly when an AI system can act, rather than simply generate text.
7. Tools
Tools allow AI systems to interact with external systems.
Examples include:
• APIs
• Databases
• Search engines
• Browsers
• Code execution environments
• Cloud services
• Enterprise applications
Tools effectively extend what an AI system is capable of doing.
Security considerations
• Tool permissions
Each tool should expose only the capabilities required by the AI system.
• Parameter validation
Tool inputs generated by a model should be validated before an external action is performed.
• Sandboxing
High risk capabilities such as code execution should be isolated from sensitive systems.
8. Applications
The application layer is what users interact with directly.
Examples include:
• Chatbots
• AI assistants
• Copilots
• Customer service systems
• Developer tools
• Enterprise workflows
Traditional application security remains important, but AI introduces additional concerns.
Security considerations
• Authentication and authorization
AI capabilities and underlying data should only be available to authorized users.
• Prompt injection
Untrusted instructions can attempt to manipulate how an AI application behaves.
• Data isolation
Multi user and multi tenant systems must prevent information from one user or organization appearing in another user’s context or response.
Security Across the AI Stack
Security is not a single layer of an AI system. It spans the entire stack and works together with governance.
AI Layers define what the system is built from, including compute, models, data, inference, RAG, agents, tools and applications.
Security protects the system through identity and authentication, access control, data protection, AI security, observability, threat detection and incident response.
Governance defines how the system is managed through inventory, risk management, policies, evaluation, human oversight, compliance and change management.
These areas are interconnected. A weakness in one can affect the others.
As AI systems become more autonomous and connected to enterprise data and external services, securing the model alone is no longer sufficient.
Secure the AI system, not just the LLM.
Understanding the complete AI stack is the first step toward building AI systems that are capable, secure and governable.