Security and Privacy for Next-Generation AI Ecosystems: A Systematic Survey and Layered Defense Framework

Security and Privacy for Next-Generation AI Ecosystems: A Systematic Survey and Layered Defense Framework | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Security and Privacy for Next-Generation AI Ecosystems: A Systematic Survey and Layered Defense Framework Rohan Gopal Kulkarni This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9459350/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 6 You are reading this latest preprint version Abstract Modern AI deployments are ecosystems, not isolated models: data pipelines, modelservices, orchestration agents, domain applications, and cloud infrastructure interact underevolving regulatory regimes. Security failures in these settings arise not just from model-level vulnerabilities but from the composition of components across layers — a class ofthreat that model-centric security frameworks structurally cannot represent. We introduce the Next-Generation AI Ecosystem Security (NAGES) framework, a six-layer model of AI ecosystems, and use it to organise a PRISMA 2020 systematic survey of152 works on AI ecosystem security and privacy spanning January 2020 to October 2025.NAGES provides formal definitions of the ecosystem, the attacker, and cross-layer security,and establishes three structural results: (i) model-centric defences cannot address lateralthreats by construction; (ii) local layer security does not compose into ecosystem-levelsecurity; and (iii) optimally allocating defences across layers is NP-hard. Empirically,two lateral attack paths — agent-to-infrastructure injection and inter-agent privilegeescalation — have no published defences in our corpus as of October 2025, and both showattack success rates above 48% on independent benchmarks. We derive eleven cross-layerthreat propagation paths, three deployment compliance profiles, and seven open researchchallenges. A fully coded spreadsheet of all 152 papers is provided as Online Resource 1. AI security large language models agentic AI cross-layer threats prompt Injection systematic survey Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviewers agreed at journal 05 May, 2026 Reviewers agreed at journal 05 May, 2026 Reviewers invited by journal 05 May, 2026 Editor assigned by journal 01 May, 2026 Submission checks completed at journal 26 Apr, 2026 First submitted to journal 19 Apr, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9459350","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":634601526,"identity":"c45e40dd-a0a0-41c2-9c21-fb97e7b53e12","order_by":0,"name":"Rohan Gopal Kulkarni","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABGklEQVRIiWNgGAWjYFACHhCRwMAHpg0k5PjZmw8AWRIyBLWwQbRYGEv2HEsAaeEhUgtDReKGGzkGcHFswLy99+DnAoa0xDaew88+FxRIJG44c+bzqxs1FjwM7IePbsCiRebMuWTpGQw5iW28bcazZxhIGM883rvNOucY0GE8aWk3sGiRkMgxkOYBuqeNn8GYmcdAQrbvzNltxjlsQC0SPGY4tBj/hmhh/wzSwthwI+eZcc4/vFrMgLaAHNYDtkVxwo0c5se5bXi08Jwxs+YxSDNu4zlTDNICCmQz5tw+CR42XH5h7zG+zVORLNvPk76ZmedPHSgqH3/O+QZiHD6GTQsEGKBy2STAJE7lWADzB1JUj4JRMApGwbAHAF//WC2LnkT/AAAAAElFTkSuQmCC","orcid":"","institution":"","correspondingAuthor":true,"prefix":"","firstName":"Rohan","middleName":"Gopal","lastName":"Kulkarni","suffix":""}],"badges":[],"createdAt":"2026-04-19 05:08:14","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9459350/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9459350/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":109056672,"identity":"404890aa-bbaa-4717-a2ae-9a3f46e9d251","added_by":"auto","created_at":"2026-05-12 07:45:12","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":451521,"visible":true,"origin":"","legend":"","description":"","filename":"SecurityandPrivacyforNextGenerationAIEcosystemsRevised.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9459350/v1_covered_bb518682-7694-4f8c-85e7-9dc358f88f09.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"\u003cp\u003eSecurity and Privacy for Next-Generation AI Ecosystems: A Systematic Survey and Layered Defense Framework\u003c/p\u003e","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"artificial-intelligence-review","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"aire","sideBox":"Learn more about [Artificial Intelligence Review](http://link.springer.com/journal/10462)","snPcode":"10462","submissionUrl":"https://submission.nature.com/new-submission/10462/3","title":"Artificial Intelligence Review","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"AI security, large language models, agentic AI, cross-layer threats, prompt Injection, systematic survey","lastPublishedDoi":"10.21203/rs.3.rs-9459350/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9459350/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eModern AI deployments are ecosystems, not isolated models: data pipelines, modelservices, orchestration agents, domain applications, and cloud infrastructure interact underevolving regulatory regimes. Security failures in these settings arise not just from model-level vulnerabilities but from the composition of components across layers — a class ofthreat that model-centric security frameworks structurally cannot represent.\u003c/p\u003e\n\u003cp\u003eWe introduce the Next-Generation AI Ecosystem Security (NAGES) framework, a six-layer model of AI ecosystems, and use it to organise a PRISMA 2020 systematic survey of152 works on AI ecosystem security and privacy spanning January 2020 to October 2025.NAGES provides formal definitions of the ecosystem, the attacker, and cross-layer security,and establishes three structural results: (i) model-centric defences cannot address lateralthreats by construction; (ii) local layer security does not compose into ecosystem-levelsecurity; and (iii) optimally allocating defences across layers is NP-hard. Empirically,two lateral attack paths — agent-to-infrastructure injection and inter-agent privilegeescalation — have no published defences in our corpus as of October 2025, and both showattack success rates above 48% on independent benchmarks. We derive eleven cross-layerthreat propagation paths, three deployment compliance profiles, and seven open researchchallenges. A fully coded spreadsheet of all 152 papers is provided as Online Resource 1.\u003c/p\u003e","manuscriptTitle":"Security and Privacy for Next-Generation AI Ecosystems: A Systematic Survey and Layered Defense Framework","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-05-12 07:38:16","doi":"10.21203/rs.3.rs-9459350/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"reviewerAgreed","content":"270092047258829037863521348828102696009","date":"2026-05-05T07:24:32+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"246266755798959161136358587144530262371","date":"2026-05-05T07:12:59+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-05-05T07:08:14+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-05-01T12:58:20+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-04-27T01:22:07+00:00","index":"","fulltext":""},{"type":"submitted","content":"Artificial Intelligence Review","date":"2026-04-19T04:58:42+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"artificial-intelligence-review","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"aire","sideBox":"Learn more about [Artificial Intelligence Review](http://link.springer.com/journal/10462)","snPcode":"10462","submissionUrl":"https://submission.nature.com/new-submission/10462/3","title":"Artificial Intelligence Review","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"92f92c52-c19a-44fe-b921-f20dd69b2481","owner":[],"postedDate":"May 12th, 2026","published":true,"recentEditorialEvents":[{"type":"reviewerAgreed","content":"270092047258829037863521348828102696009","date":"2026-05-05T07:24:32+00:00","index":12,"fulltext":""},{"type":"reviewerAgreed","content":"246266755798959161136358587144530262371","date":"2026-05-05T07:12:59+00:00","index":11,"fulltext":""},{"type":"reviewersInvited","content":"5","date":"2026-05-05T07:08:14+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-05-01T12:58:20+00:00","index":"","fulltext":""}],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-05-12T07:38:17+00:00","versionOfRecord":[],"versionCreatedAt":"2026-05-12 07:38:16","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9459350","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9459350","identity":"rs-9459350","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}