Nondeterministic artificial intelligence (AI) applications operate and produce results differently than traditional, deterministic IT applications. AI models can produce varying outputs even when given the same input. What explains this behavior?
AI models are probabilistic: They generate the most probable output, not necessarily the most accurate one. Such an evolution in operation and output requires a new approach to designing secure systems —one that honors this distinction and simultaneously maintains a comprehensive and unified view of AI-enabled systems.
This can be achieved by dividing traditional architecture into 2 planes: a model architecture that encompasses all AI model components and a services architecture that includes all IT components enabling the AI model. A dual plane approach will increase visibility into the inherent risk of AI applications, and deploying the appropriate safeguards and countermeasures will enable organizations to reduce the risks posed to sensitive systems to acceptable levels.
Understanding the Nondeterministic Nature of AI Models
Unlike traditional systems, developers often do not define logic or rules for AI models. Instead, these systems are trained on a large corpus of information that allows them to identify patterns that can be used to define and build their own logic and rules.1
When a system or user requests information from the AI model, the model determines which output has the highest probability of meeting the criteria of the request. In other words, AI models are probabilistic systems that generate responses based on learned patterns instead of deterministic rules.
This presents a significant challenge for security professionals determining whether model outputs conform to the range of expected outputs or if they are being modified, for example, as part of a cybersecurity attack. Traditional detection tools rely on signatures, rules, and known patterns. However, these capabilities are not effective at interpreting model behavior or detecting small changes in inputs that influence model outputs.
Deterministic IT Systems
Information technology systems, however, are deterministic; this means that they generate the same response to the same input every time.2 A deviation in a deterministic system represents a problem to be addressed (such as an application bug that needs to be fixed). This behavior ensures that traditional IT systems are predictable and testable. In other words, system outputs can be explained by the logic written in the source code of the application.
AI models and traditional IT systems operate differently, fail differently, and consequently require different countermeasures and safeguards to reach acceptable levels of risk. Acknowledging this difference is vital. By integrating dual plane security, organizations can tailor their defenses to manage the distinct vulnerabilities of AI models while maintaining robust protection for their traditional IT infrastructure.
Dual Plane Security
In a dual plane security model, the first plane is model architecture, which represents the building blocks of any AI model. Some key elements of this plane include:
- Model weights — The learned numerical parameters that codify the model’s knowledge and determine how it transforms inputs into outputs
- Training data — The dataset used to teach AI models how to recognize patterns, make predictions, or generate outputs
- Inference pipeline — The sequence through which an AI system receives an input, processes it using its trained model, and produces an output
- Feature store/embeddings — Vector representations of data (embeddings) and the systems that store, retrieve, and manage them
- Model application programming interfaces (APIs) — The interfaces (typically HTTPs endpoints) that allow applications to send data to AI models
- Configurations and hyperparameters — The settings that control model behavior and training
The second plane is services architecture, which comprises the IT systems that provide the required infrastructure for the AI model to operate. Elements of this plane include:
- Load balancers — Devices that distribute incoming traffic across multiple servers to improve availability, performance, and fault tolerance
- API gateways — Systems that manage, secure, route, and throttle API requests to protect services
- Web application firewalls (WAFs) — Security devices that inspect and filter web traffic to block attacks such as structured query language (SQL) injections, cross-site scripting (XSS), and malicious payloads
- Distributed denial of service (DDoS) protection services — Services that mitigate DDoS attacks by absorbing, filtering, or limiting malicious traffic
- Storage systems — Devices used to store, retrieve, and manage data
- Logging systems — Platforms that collect, store, and index system and application logs for troubleshooting, auditing, and security analysis
- Monitoring systems — Platforms that track system and application health, performance, and anomalies to ensure availability
Dividing AI-enabled applications into 2 architectural planes provides security professionals with a robust method for developing systems that take into consideration the nuances of both nondeterministic and deterministic technologies.
Dual Plane Architecture in Practice
To understand how dual plane security would work in practice, consider the following example.
A bicycle component manufacturer has identified that local bike shops select bike components based on the complexity of installing, troubleshooting, and maintaining them. In response to this insight, the bicycle manufacturer decided to deploy an AI-enabled application to assist the mechanics at local shops in solving any problem with their components. The bicycle manufacturer’s solutions architect and security architect decided to host the application in a public cloud and divided the architecture into two main components: model architecture and services architecture.
The solutions architect was responsible for determining the technologies, components, and integration patterns necessary to meet business requirements. As a result of this determination, the solutions architect designed a blueprint that defined how each component works together to deliver the intended solution. The security architect evaluated that blueprint to identify threats, vulnerabilities, and any resulting risk introduced by the proposed design. Based on this analysis, the security architect recommended a set of new security controls to mitigate the identified risk. As a final measure, the security architect recommended the use of retrieval‑augmented generation (RAG)3 to reduce the likelihood of hallucinations. A knowledge database was also connected to the AI application to improve the accuracy of its responses.
Figure 1 illustrates a blueprint that maps specific security controls and components across each architecture plane. It also shows that model architecture contains the AI model responsible for generating responses consumed by microservices in the services architecture. AI runtime protection is a critical control in this plane because it protects the model against prompt injection, evasion techniques, model extraction, and other AI specific attacks.
Figure 1—Visualization Demonstrating the Elements of Each Plane
Protecting Model Architecture
Securing AI models and their components can only be accomplished through a shift in how professionals think about developing and using tools. This, coupled with new controls, will ensure that the AI model is generating results according to organizational security requirements. Understanding the risk profile of an AI model is vital to the identification, selection, deployment, and optimization of security controls specific to AI. AI risk can appear in several forms:
- Hallucinations — AI models generate probabilistic outputs, and those outputs may be fabricated by the model in cases where the model lacks knowledge. Consequently, it can generate incorrect outputs that are not based on facts. Implementing RAG materially reduces this risk by grounding the model outputs in validated knowledge sources.
- Data poisoning — This occurs when an attacker obtains access to training data repositories and subsequently modifies the data. Protecting training data with strong access controls, immutable data stores, isolated training environments, and performing anomaly detection validations helps reduce the occurrence of this type of attack.
- Prompt injection — An attacker embeds malicious instructions in prompts, retrieved data, or external content to override AI policies and modify the model’s behavior at runtime. AI runtime protections are required to detect and block this common attack.
- Model extraction — In this type of attack, the attacker’s goal is to copy the inner workings of an AI model by calling the model’s API with multiple inputs and then storing the responses. They are then used to train a surrogate model to replicate the behavior and performance of the target model. AI runtime protections are required to detect anomalous query patterns, block malicious input sequences, and prevent sensitive data from being exfiltrated to an attacker, thereby reducing the likelihood and impact of model extraction to an acceptable risk level.
Protecting Service Architecture
Identifying security controls for traditional IT systems should not be a challenge for organizations today. In fact, many security reference architectures can serve as baselines for selecting effective safeguards and countermeasures to mitigate the inherent risk in traditional IT systems. AI models require a robust and secure IT infrastructure to operate. Exactly what type of infrastructure that will be depends on an enterprise’s specific business requirements. Some options available include:
- AI as a service (AIaaS) allows organizations to access pretrained models instead of building or maintaining an in-house AI infrastructure. In this case, most of the elements of model architecture will be maintained by the vendor, with the services architecture maintained by the purchasing organization.
- Infrastructure as a service or on-premises deployment means that the organization has full control of the AI model and full responsibility for all security controls needed to protect the model and its data.
Selecting the right service architecture for AI implementation involves balancing security needs with business requirements. Organizations must carefully consider whether to leverage AIaaS, ensuring vendor-managed model architecture and internally managed service architecture, or to opt for on-premises infrastructure, which offers greater control but also places the onus of security entirely on the organization.
Conclusion
The proposed architecture partitioning assists in the assignment of roles and responsibilities: AI teams own the nondeterministic elements, while platform and application teams are responsible for the deterministic systems. AI models have different failure modes than deterministic systems and placing them in their own plane prevents any instability from cascading into business logic. Regulatory compliance is simplified by cleanly mapping the controls that apply to each plane. The rationale behind the selection of controls for each plane can be clearly explained, strengthening the overall business case for funding AI-specific security controls. This will not only help organizations develop and implement safe and secure AI tools, but also justify the costs associated with adopting any emerging technology.
Separating nondeterministic components from deterministic components in integrated model architecture and services architecture reduces the cognitive burden of identifying the right security controls for a reliable and secure AI-enabled application.
Endnotes
1 Shruthi-Gnana, M.; "Effective Change Management to Mitigate AI Risks,” ISACA®, 11 August 2025
2 Mueller, B.; Understanding and Mitigating the Risk of AI vs. Traditional Software, ISACA Industry News, 27 March 2023
3 Amazon Web Services, What is RAG (Retrieval-Augmented Generation)?
Quetzalcoatl Contreras
Is an experienced cybersecurity leader specializing in multicloud security, zero trust architecture, and AI‑driven defense. He has led global security programs across Azure, AWS, GCP, and Alibaba, architected resilient software as a service (SaaS) and AI platforms, and delivered measurable risk reduction for large enterprises. His work reflects a commitment to advancing security governance, operational excellence, and the integration of AI‑driven capabilities into secure enterprise architectures.