构建可互操作的AI缺陷报告系统,提升安全漏洞上报效率
FLARE-AI: Flaw Reporting for AI

- 用条件逻辑和分类机制自动收集关键信息,简化报告流程
- 支持单次提交向多个开发者、协调方和注册库分发标准化报告
- 基于12个系统审计与49位专家反馈,兼顾实用性与生态协同
已部署AI系统的缺陷报告对识别系统故障、提升AI安全至关重要。然而当前报告生态碎片化:发现者常不知如何报告,接收方也极少共享信息,导致报告重复且缺乏标准格式。我们审计了由AI开发商、网络安全组织及缺陷聚合平台发布的12个报告系统,归纳出五类设计挑战:可发现性、范围界定、信息采集、协作机制及严格责任案例指导。基于此分析及来自32家机构的49名专家反馈,提出FLARE-AI——一个开源的可互操作AI缺陷报告系统。该系统通过条件逻辑和早期分类,自动收集可用于初步筛选的信息;单次提交即可选择性将标准化、机器可读的报告分发至多个开发者、协调方和事件注册库。通过降低报告门槛并增强跨主体互操作性,FLARE-AI有助于打破信息孤岛,加速整个AI生态的修复进程。
原文摘要 · Abstract (English)
Flaw reporting for deployed AI systems is fundamental to identifying system failures and improving AI safety. Yet the AI reporting ecosystem is fragmented: researchers who identify flaws often do not know what or where to report, and groups who receive reports rarely share them with other relevant stakeholders. As a result, good-faith reporters duplicate effort by submitting many different forms, and recipients lack standardized, triage-ready information. We audit 12 reporting systems published by AI developers, cybersecurity groups, and AI flaw aggregators, identifying five recurring design challenges spanning discoverability, scope, information collection, coordination, and guidance for strict-liability cases. Building on this analysis and feedback from 49 experts across 32 organizations representing developers, security researchers, and ecosystem coordinators, we introduce FLARE-AI, an open-source AI flaw reporting system designed for interoperability with existing systems. FLARE-AI streamlines flaw report creation by collecting triage-relevant information through conditional logic and early classification, then enables optional dissemination of standardized, machine-readable reports to multiple developers, coordinators, and incident registries from a single submission. By lowering barriers to reporting AI flaws and improving interoperability across stakeholders, FLARE-AI helps break down silos and accelerate remediation across the AI ecosystem.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。