Zero-Day

In Cybersecurity, including the security of Artificial Intelligence systems, “zero-day” is ambiguous: Zero-Day Vulnerability—flaw unknown to responsible maintainers; Zero-Day Exploit—technique exploiting such a flaw; or Zero-Day Attack—attack using such an exploit. The term does not require recent discovery, and an unpatched flaw is not automatically a zero-day. In Machine Learning pipelines, Model Weights, Training Data, and Inference infrastructure can be targets of security attacks, potentially compromising Data Privacy or enabling Model Evasion; these are security concerns, not a distinct machine-learning meaning of zero-day. Google DeepMind and OpenAI use Red Teaming to investigate vulnerabilities and unsafe behaviors in Large Language Models, but Prompt Injection and Data Poisoning are attack classes, not inherently zero-day exploits. Mitigation may involve Anomaly Detection, Incident Response, compensating controls, or vendor fixes; AI-powered Automated Patch Management is not a defining element of zero-day defense. Mitigation does not require or need to await a CVE identifier, which may be assigned before or after disclosure.