YAPAY ZEKÂ DENETİMİ

Öz

Yapay zeka (YZ) sistemlerinin kritik sektörlerde hızla yaygınlaşması, güvenlik, gizlilik ve etik açıdan önemli riskleri beraberinde getirmektedir. Geleneksel bilgi güvenliği denetim yaklaşımları, veri bütünlüğü, model güvenliği ve algoritmik şeffaflık gibi yapay zekaya özgü riskleri ele almakta yetersiz kalmaktadır. Bu çalışma, yönetişim, veri güvenliği, model güvenliği ve uygulama güvenliği boyutlarını kapsayan bütüncül ve risk tabanlı bir yapay zeka denetim metodolojisi önermektedir. Önerilen metodoloji, temsili kontrol hususlarıyla desteklenen dokümantasyon, uyumluluk, erişim kontrolü, uygulama güvenliği ve model güvenliği dahil olmak üzere temel kontrol alanları etrafında yapılandırılmıştır. Önerilen metodoloji, yapılandırılmış, güvence odaklı bir çerçeve aracılığıyla yapay zeka denetim kontrollerinin sistematik değerlendirilmesini desteklemektedir. Ayrıca, kontroller risk seviyelerine göre önceliklendirilerek veri zehirleme, model tersine mühendislik, prompt enjeksiyonu ve hassas veri sızıntısı gibi kritik tehditlere odaklanılması sağlanmaktadır. Metodoloji; kapsam belirleme, kontrol eşleştirme, veri toplama, değerlendirme ve raporlama adımlarından oluşan sistematik bir denetim süreci sunmaktadır. Bu yapı sayesinde yapay zeka sistemlerinin hem teknik hem de yönetsel boyutları bütüncül bir şekilde değerlendirilebilmektedir. Çalışma, ölçülebilir, uygulanabilir ve düzenleyici gereksinimlerle uyumlu bir çerçeve sunarak literatüre katkı sağlamaktadır. Sonuç olarak önerilen yapay zeka denetim çerçevesi, YZ sistemlerinin denetlenebilirliğini, şeffaflığını ve güvenliğini artırarak kurumların ortaya çıkan riskleri etkin bir şekilde yönetmesine yardımcı olmaktadır.

Anahtar Kelimeler

• Yapay Zeka Denetimi
• Yapay Zeka Güvenliği
• Risk Tabanlı Denetim
• Yapay Zeka Yönetişimi
• Uyum

AUDITING ARTIFICAL INTELLIGENCE

Öz

The rapid proliferation of artificial intelligence (AI) systems across critical sectors has introduced significant security, privacy, and ethical challenges. Traditional information security audit frameworks remain insufficient to address the unique risks associated with AI technologies, particularly in areas such as data integrity, model robustness, and algorithmic transparency. This study proposes a comprehensive and risk-based AI audit methodology that integrates governance, data security, model security, and application security dimensions into a unified control framework. The proposed methodology is structured around key control domains, including documentation, compliance, access control, application security, and model security, supported by representative control considerations. The proposed methodology supports systematic evaluation of AI audit controls through a structured assurance-oriented framework. Additionally, a risk prioritization approach is introduced to classify controls into different criticality levels, enabling organizations to focus on high-impact vulnerabilities such as data poisoning, model inversion, prompt injection, and sensitive data leakage. The methodology is designed as a step-by-step audit process, including scope definition, control mapping, evidence collection, evaluation, and reporting. This structured approach ensures both technical and organizational aspects of AI systems are systematically assessed. The study contributes to the literature by providing a practical, measurable, and adaptable framework that aligns with regulatory requirements such as data protection laws and ethical AI principles. Overall, the proposed AI audit framework enhances the auditability, transparency, and security of AI systems, offering organizations a robust tool to manage emerging AI-related risks effectively.

Anahtar Kelimeler

• AI Audit
• AI Security
• Risk-Based Audit
• AI Governance
• Compliance

Kaynakça

1. Acemoglu, D., & Restrepo, P. (2019). "Automation and New Tasks: How Technology Displaces and Reinstates Labor." Journal of Economic Perspectives, 33(2), 3–30.
2. Amodei, D., et al. (2016). "Concrete Problems in AI Safety." arXiv preprint arXiv:1606.06565.
3. Ananny, M., & Crawford, K. (2018). Seeing without knowing: Limitations of the transparency ideal and its application to algorithmic accountability. New Media & Society, 20(3), 973–989.
4. Anderljung, M., Barnhart, J., Korinek, A., et al. (2023). Frontier AI Regulation: Managing Emerging Risks to Public Safety. arXiv preprint arXiv:2307.03718.
5. Anderson, R. (2020). Security Engineering: A Guide to Building Dependable Distributed Systems (3rd ed.). Wiley.
6. Ashmore, R., et al. (2021). Assuring the Machine Learning Lifecycle: Desiderata, Methods, and Challenges. ACM Computing Surveys.
7. Barocas, S., Hardt, M., & Narayanan, A. (2023). Fairness and Machine Learning: Limitations and Opportunities. MIT Press.
8. Biggio, B., & Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84, 317–331.

9. Birhane, A., Steed, R., Ojewale, V., Vecchione, B., & Raji, I. D. (2024). AI auditing: The Broken Bus on the Road to AI Accountability. Proceedings of the 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML).
10. Brundage, M., et al. (2020). Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims. arXiv preprint arXiv:2004.07213 / GovAI Technical Report.
11. Burrell, J. (2016). How the machine ‘thinks’: Understanding opacity in machine learning algorithms. Big Data & Society, 3(1).
12. Caralli, R. A., et al. (2010). CERT Resilience Management Model (CERT-RMM): A Maturity Model for Managing Operational Resilience. Addison-Wesley Professional.
13. Cath, C. (2018). "Governing artificial intelligence: ethical, legal and technical opportunities and challenges." Philosophical Transactions of the Royal Society A.
14. Cobbe, J., Lee, M. S., & Singh, J. (2020). Reviewable Automated Decision-Making: A Framework for Accountability. Computer Law & Security Review.
15. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2023). Realize the full potential of artificial intelligence: Applying the COSO framework and principles to help implement and scale artificial intelligence.
16. Common Criteria Recognition Arrangement. [CCRA], (2022). Arrangement on the recognition of Common Criteria certificates in the field of information technology security. Common Criteria Portal.
17. Costanza-Chock, S. (2020). Design Justice: Community-Led Practices to Build the Worlds We Need. MIT Press.
18. European Parliament, & Council of the European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonized rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts. Official Journal of the European Union, OJ L, 2024/1689.
19. Falco, G., Shneiderman, B., Badger, J., et al. (2021). Governing AI Safety Through Independent Audits. Nature Machine Intelligence, 3(7), 566–571.
20. Floridi, L., et al. (2018). AI4People—An Ethical Framework for a Good AI Society: Opportunities, Risks, Principles, and Recommendations. Minds and Machines, 28(4), 689–707.
21. Gasser, U., & Almeida, V. A. (2017). "A Layered Model for AI Governance." IEEE Internet Computing.
22. Gebru, T., Morgenstern, J., Vecchione, B., et al. (2021). Datasheets for Datasets. Communications of the ACM, 64(12), 86–92.
23. Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and Harnessing Adversarial Examples. International Conference on Learning Representations (ICLR).
24. Guidotti, R., et al. (2018). A Survey of Methods for Explaining Black Box Models. ACM Computing Surveys (CSUR), 51(5), 1–42.
25. Hevner, A. R., et al. (2004). Design Science in Information Systems Research. MIS Quarterly, 28(1), 75-105.
26. ISO/IEC 15408:2022. Information security, cybersecurity and privacy protection — Evaluation criteria for IT security. International Organization for Standardization.
27. ISO/IEC 18045:2022. Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Methodology for IT security evaluation.
28. ISO/IEC 23894:2023. Information technology — Artificial intelligence — Guidance on risk management. International Organization for Standardization.
29. ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
30. ISO/IEC 42001:2023. Information technology — Artificial intelligence — Management system. International Organization for Standardization.
31. Ji, Z., et al. (2023). Survey of Hallucination in Natural Language Generation. ACM Computing Surveys.
32. Jobin, A., Ienca, M., & Vayena, E. (2019). The global landscape of AI ethics guidelines. Nature Machine Intelligence, 1(9), 389–399.
33. Jordan, M. I., & Mitchell, T. M. (2015). "Machine learning: Trends, perspectives, and prospects." Science, 349(6245), 255–260.
34. Kaminski, M. E., & Malgieri, G. (2021). Algorithmic Impact Assessments under the GDPR: Producing Multi-layered Explanations. International Data Privacy Law.
35. Kroll, J. A., et al. (2015). "Accountable Algorithms." University of Pennsylvania Law Review, 165, 633.
36. LeCun, Y., Bengio, Y., & Hinton, G. (2015). "Deep learning." Nature, 521(7553), 436–444.
37. Leocádio, D., Malheiro, L., & Reis, J. (2024). Artificial Intelligence in Auditing: A Conceptual Framework for Auditing Practices. Administrative Sciences, 14(10), 238
38. Madry, A., et al. (2019). Towards Deep Learning Models Resistant to Adversarial Attacks. International Conference on Learning Representations (ICLR).
39. Mehrabi, N., et al. (2021). A Survey on Bias and Fairness in Machine Learning, ACM Computing Surveys (CSUR), Volume 54, Issue 6, Article No.: 115, Pages 1 - 35
40. Metcalf, J., et al. (2021). "Algorithmic Impact Assessments and Accountability." Communications of the ACM.
41. Metaxa, D., et al. (2021). Algorithm Auditing: Methods, Ethics, and Best Practices. Foundations and Trends® in Human–Computer Interaction.
42. Mitchell, M., Wu, S., Zaldivar, A., et al. (2019). Model Cards for Model Reporting. Proceedings of the Conference on Fairness, Accountability, and Transparency (FAccT), 455–464.
43. Mökander, J. (2023). Auditing of AI: Legal, Ethical and Technical Approaches. Digital Society, 2(3), 49.
44. Mökander, J., & Floridi, L. (2021). Ethics-based auditing to promote trustworthy AI. Minds and Machines, 31(2), 323–357.
45. Mökander, J., et al. (2021). "Ethics-Based Auditing of Automated Decision-Making Systems: Nature, Scope, and Limitations." Science and Engineering Ethics.
46. NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology.
47. Nussbaum, M. C. (2009). Creating Capabilities: The Human Development Approach. Harvard University Press.
48. OWASP (2023). Top 10 for Large Language Model Applications. Open Web Application Security Project.
49. Papernot, N., et al. (2018). "SoK: Security and Privacy in Machine Learning." IEEE European Symposium on Security and Privacy (EuroS&P).
50. Raji, I. D., et al. (2020). Closing the AI accountability gap: Defining an internal algorithmic auditing framework. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAccT), 33–44.
51. Raji, I. D., et al. (2022). Outsider Oversight: Corporate Responsibility and the Role of External AI Audits. Proceedings of the 2022 AAAI/ACM Conference on AI, Ethics, and Society.
52. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE.
53. Sambasivan, N., et al. (2021). “Everyone wants to do the model work, not the data work”: Data Cascades in High-Stakes AI. CHI Conference.
54. Sandvig, C., et al. (2014). Auditing Algorithms: Research Methods for Detecting Discrimination on Internet Platforms. Data and Discrimination: Converting Critical Concerns into Productive Inquiry.
55. Schiff, D., et al. (2020). "Principles to Practices for Responsible AI: Closing the Gap." arXiv preprint arXiv:2006.04707.
56. Selbst, A. D., et al. (2019). Fairness and Abstraction in Sociotechnical Systems. Proceedings of the 2019 Conference on Fairness, Accountability, and Transparency (FAccT).
57. Wieringa, M. (2020). What to account for when accounting for algorithms: A systematic literature review on algorithmic accountability. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAccT).