arXiv: Formalization of security

The publication, titled "Formalization of security" under the AI_SAFETY framework, introduces a rigorous mathematical and logical structure for defining and verifying security properties in AI systems. It moves beyond informal best practices to propose a formal specification language that can be used to prove that an AI model's behavior adheres to predefined safety constraints, including adversarial robustness and containment. This is a foundational academic paper, not a binding regulation, but it signals a shift toward verifiable, rather than merely asserted, AI security claims.

The primary audience is organizations developing or deploying high-risk AI systems, particularly in finance, healthcare, critical infrastructure, and autonomous systems. Compliance teams in these sectors will be affected because the paper's formal methods are likely to become the basis for future technical standards or audit requirements under the EU AI Act and similar regimes. Regulators and notified bodies may soon expect evidence of formal verification for high-risk use cases, making this paper a preview of upcoming conformity assessment expectations.

Compliance teams should immediately review their current AI security testing procedures and identify gaps where informal testing is used. They should begin piloting formal verification tools on a small, non-critical model to build internal capability and document the process. Additionally, they should monitor the AI_SAFETY framework for updates, as this paper may be a precursor to a draft technical standard. Proactively aligning internal documentation with these formal methods now will reduce future remediation costs and demonstrate due diligence to auditors.