Repository navigation
Web Neural Network API 2025-03-20 > 2025-06-20 #85
Description
Activity
This is a last call for security review comments. If someone is actively reviewing this specification, please let us know here so we can plan our next publication schedule accordingly. Thank you!
hi @anssiko, thank you for the reminder.
I have read the Security Considerations. They are well-written in a narrative form, and I have no particular comments; I agree with what is noted.
I don't know if you think this Threat Model (in progress) could be useful.
Thank you,
Simone
Reacted by Anssi Kostiainen@simoneonofri thank you for your review!
I've penciled in discussion on security to the WebML WG/CG's TPAC agenda. Would you prefer Mon or Tue on the TPAC week? This is relevant to both the WebNN API (WG) and various LLM-backed built-in AI APIs (CG), thus we have flexibility in scheduling the security discussion.
I added the threat model to the group's TPAC F2F agenda webmachinelearning/meetings#35 for further discussion.
@simoneonofri, feel free to remove the pending label from this issue.
I will close this review issue now as completed. Thank you again!
name of spec to be reviewed: Web Neural Network API
URL of spec: https://www.w3.org/TR/webnn/
Does your document have an in-line Security Considerations section, separate from Privacy Considerations?
What and when is your next expected transition?
What has changed since any previous review? See Other comments
Please point to the results of your own self-review:
Where and how to file issues arising?
Pointer to any explainer for the spec?
Other comments:
This API has received security review in 2022 and 2024.
The specification has also continued to receive Chrome security team review as part of the implementation effort, following the initial Chrome security team review focused on the specification text.
The group has addressed all but one security-tracker issues reported. The remaining open issue is proposed to be addressed by new conformance tests which explicitly perform out-of-bounds access. In part for this purpose, the API has added new errors to to detect if the context is no longer available to fulfill requests e.g. due to a crash or other malfunction.
Further suggestions from security reviewers are welcome in particular for appropriate conformance tests for hardening possible failure paths.