Added to Cloudflare’s Web Application Firewall (WAF) offerings, Firewall for AI is designed to prevent the exploitation of AI models, specifically generative AI. Credit: Shutterstock Cloudflare has infused into its Web Application Firewall (WAF) offering a new capability, dubbed Firewall for AI, focused on AI models in a bid to add a protection layer for large language models (LLMs). The capability, which is specially tailored for applications using LLMs, will contain a suite of existing and new WAF tools to analyze submitted prompts and identify attempts of exploitation. “Firewall for AI is agnostic to the specific deployment and can be deployed in front of models hosted on Cloudflare Workers AI or models hosted on any other third-party infrastructure – as long as the traffic is proxied through Cloudflare WAF,” said a Cloudflare spokesperson. “Customers will be able to control and set up Firewall for AI using the WAF control plane.” Cloudflare Workers AI is an open, pay-as-you-go AI inference-as-a-service platform, that lets developers run machine learning models on the Cloudflare network from their own code. Additionally, Cloudflare has announced a new Defensive AI program that will use the technology to fight a growing number of AI-based attacks concerning APIs, emails, and insider incidents. Protection against DoS and data leakage The new firewall offering is specifically designed for customers running an AI on Cloudflare Workers AI to protect against concerns such as prompt injection and data leakage. It will scan and evaluate prompts submitted by a user to block model exploitation and attempts to extract data. The capability is developed by leveraging a combination of heuristics and proprietary AI layers to evaluate prompts and identify abuses and threats. “Firewall for AI will protect against Model Denial of Service and Sensitive Information Disclosure, which leverage tools and features available to all customers as part of the Web Application Firewall,” the Cloudflare spokesperson said. “Firewall for AI will also run a series of detections designed to identify prompt injection attempts and other abuses — e.g., ensuring the topic stays within the boundaries defined by the model owner.” Firewall for AI’s prompt validation is currently under development and a beta version will be released in the coming months, the spokesperson added. Defensive AI to detect anomalous behavior Under a new Defensive AI program, Cloudflare is working on AI-based models to look at specific customer traffic patterns and build a baseline of normal behavior to help detect any anomalies across environments including APIs, emails, and employee access. “Defensive AI is the framework Cloudflare uses when thinking about how intelligent systems can improve the effectiveness of security solutions,” the Cloudflare spokesperson said. “Cloudflare uses AI to increase the level of protection across all security areas, ranging from application security and email security to Cloudflare’s Zero Trust platform.” The AI models are tailored for the specific application, so API protection uses different models than email or zero trust, Cloudflare spokesperson said. Although the implementation might differ, the concepts are similar — for example, tailoring the model to the traffic pattern of specific customers or identifying a baseline of normal behavior and using that to identify anomalies. While Firewall for AI is already available to Cloudflare customers with the launch, the Defensive AI models are currently under development and the company is yet to announce the launch date. Related content news AT&T suffers critical breach impacting 73 million customers Data released on the dark web impacts 7.6 million existing account holders and 65.4 million past subscribers. By Shweta Sharma 01 Apr 2024 4 mins Data Breach feature Recruit for diversity: Practical ways to remove bias from the hiring process Changing the wording on job descriptions and introducing a diverse hiring panel are some of the ways to remove bias when hiring cybersecurity professionals. By Aimee Chanthadavong 01 Apr 2024 8 mins Careers feature The CSO guide to top security conferences Tracking postponements, cancellations, and conferences gone virtual — CSO Online’s calendar of upcoming security conferences makes it easy to find the events that matter the most to you. By CSO Staff 01 Apr 2024 17 mins Technology Industry IT Skills Events news Top cybersecurity product news of the week New product and service announcements from Bedrock Security, GitGuardian, Legit Security, Nametag, and Cybereason and Observe By CSO staff 29 Mar 2024 70 mins Generative AI Security PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe