Secure A.I. Act of 2024

This bill aims to improve the tracking and processing of security and safety incidents and risks associated with artificial intelligence (AI). It defines key terms, establishes voluntary databases and processes for vulnerability management, updates existing programs, and creates a new AI Security Center.

Sec. 2, Definitions: Defines "artificial intelligence safety incident" as an event increasing risk of physical or psychological harm or endangering life, health, property, or the environment. Defines "artificial intelligence security incident" as an event increasing risk of information extraction or system manipulation by a third party. Defines "artificial intelligence security vulnerability" as a weakness exploitable to subvert confidentiality, integrity, or availability, including data poisoning, evasion, privacy-based, and abuse attacks. Defines "counter-artificial intelligence" as techniques to extract information or learn to manipulate an AI system.

Sec. 3, Voluntary tracking and processing of security and safety incidents and risks associated with artificial intelligence: Directs the Director of the National Institute of Standards and Technology (NIST) to update the National Vulnerability Database to incorporate AI security vulnerabilities and identify vulnerabilities unsuitable for that database. Requires NIST, with the Cybersecurity and Infrastructure Security Agency (CISA), to establish a voluntary public database to track AI security and safety incidents, with mechanisms for voluntary information sharing, standardized formats, and incident classification. The Director determines which incidents are material for inclusion, prioritizing those involving critical infrastructure, high-severity impacts, or widely used systems. The database is populated from public reports and shared information, with anonymization of affected parties unless they consent.

Sec. 4, Updating processes and procedures relating to Common Vulnerabilities and Exposures Program and evaluation of consensus standards relating to artificial intelligence security vulnerability reporting: Directs the CISA Director to update the Common Vulnerabilities and Exposures Program to identify AI security vulnerabilities and develop processes for those unsuitable. Requires NIST to evaluate whether existing voluntary consensus standards for vulnerability reporting accommodate AI security vulnerabilities and report to Congress. If standards are insufficient, NIST must update reporting processes, including Binding Operational Directive 20-01. Requires CISA to convene a process to develop best practices for addressing supply chain risks in training and maintaining AI models, covering data collection, documentation, human feedback, open-source datasets, and proprietary datasets. The Director must avoid duplicating requirements under the Cyber Incident Reporting for Critical Infrastructure Act of 2022.

Sec. 5, Establishment of Artificial Intelligence Security Center: Directs the Director of the National Security Agency (NSA) to establish an Artificial Intelligence Security Center within the NSA's Cybersecurity Collaboration Center. Its functions include providing a research test-bed for private and academic researchers on a subsidized basis, developing guidance to counter counter-AI techniques, promoting secure AI adoption for national security systems and the defense industrial base, and coordinating with the AI Safety Institute. The test-bed must have terms of usage protecting classified or proprietary information, be available to federal agencies on a cost-recovery basis, and leverage infrastructure from a 2023 Executive Order. The Director must establish mechanisms to ensure access to proprietary models by qualified researchers, with voluntary provision by vendors.