AAISM · Topic 3
AI Data Security
Domain: AI Technologies and Controls, about 38% of the exam
The AI data lifecycle
- Source
- Consent and rights
- Ingest
- Label
- Transform
- Train
- Store
- Retain
- Dispose
- Provenance
- origin, history, transformations documented
- Lineage
- which data produced which model
- Chain of custody
- every handler and change recorded
- Immutability
- provenance records cannot be edited
- Data versioning
- Git-like snapshots of datasets
- Data contract
- schema, quality, ownership agreed upfront
- Retention
- keep only as long as justified
Provenance answers where the data came from; lineage answers what it was used for; both must be captured automatically in the pipeline
Poisoning defenses
- Authenticate and validate every source
- Checksums and signatures on datasets
- Schema and range validation at ingest
- Outlier and spectral signature detection
- Data sanitization before training
- Label audits with independent reviewers
- Freeze and version approved training sets
Labeling integrity
- Label flipping is a poisoning vector
- Crowd labelers are supply chain dependencies
- Inter-annotator agreement as quality metric
- Gold-standard samples catch careless labelers
- Sensitive data exposed to labelers minimized
- Insiders can manipulate labels silently
- Log who labeled what and when
Access and protection
- RBAC plus ABAC
- least privilege on training data
- Encryption at rest
- disks, buckets, databases
- Encryption in transit
- TLS between pipeline stages
- Access logging
- audit trail for forensics
- Data minimization
- collect only what training needs
- Segregation
- training data apart from production
- Insider threat
- poison, exfiltrate, relabel
Privacy risk in models
- Models memorize and regurgitate training records
- Membership inference reveals who was included
- Model inversion rebuilds sensitive inputs
- Gradient inversion leaks federated data
- Bias is an integrity concern too
- DPIA required for high-risk personal processing
- Consent must be specific to AI purposes
Privacy-enhancing technologies
Differential privacy
- Calibrated noise, mathematical guarantee
- Epsilon budget: lower is stronger
- DP-SGD clips and noises gradients
- Renyi DP gives tighter composition
- PATE: noisy teacher ensemble votes
- Hurts underrepresented groups more
Federated learning
- Raw data never leaves the site
- Updates still leak without protection
- Combine with secure aggregation
- Rogue clients can poison updates
Cryptographic methods
- SMPC: joint compute, private inputs
- Homomorphic: compute on ciphertext
- Both costly, use narrowly
- Confidential computing: hardware enclaves
Synthetic data
- Generated to mimic real distributions
- Reduces exposure of personal records
- Can still leak through memorization
- Utility drops for rare cases
- Validate fidelity and privacy before use
- Document generation method in provenance
Third-party and vendor data
- Verify collection methods and consent
- Confirm licenses and usage rights
- Assess quality and representativeness
- Check for embedded poison or bias
- Contract for provenance documentation
- Scraped web data carries copyright risk
- Data broker sources need due diligence
Regulatory hooks
- GDPR DPIA
- systematic privacy impact, high risk
- Purpose limitation
- training is a new purpose
- Data subject rights
- access, erasure, unlearning challenge
- EU AI Act Article 10
- relevant, representative, error-checked data
- ISO 42001 data controls
- quality, provenance, preparation documented
- Sector rules
- HIPAA, GLBA still apply
Secure data pipeline
- Authenticated ingest
- Validate
- Encrypt
- Transform with lineage
- Versioned store
- Training access logged
- Capture metadata at every stage
- Feature stores inherit access rules
- Test data kept separate from training
Retention and disposal
- Retention schedule per data class
- Delete raw data once features derived
- Erasure requests may require retraining
- Machine unlearning is immature, plan around
- Backups and checkpoints hold copies too
- Certificates of destruction from vendors
Key terms
- Epsilon
- privacy loss budget
- DP-SGD
- clipped, noised gradient descent
- PATE
- private teacher ensemble aggregation
- SMPC
- secure multi-party computation
- DVC
- data version control
- Data contract
- producer and consumer agreement
- Lineage
- data to model traceability
Reference strip: lifecycle, poisoning, PETs, privacy, governance
Lifecycle
- Provenance, lineage, custody, versioning
- Automate metadata capture
- Immutable records, audited access
- Retain, then dispose deliberately
Poisoning
- Validate sources and schemas
- Sign and hash datasets
- Audit labels, detect outliers
- Freeze approved training sets
PETs
- DP: noise and epsilon budget
- Federated: data stays local
- SMPC and homomorphic: costly, precise
- Synthetic: check fidelity and leakage
Privacy attacks
- Membership and attribute inference
- Model and gradient inversion
- Memorized records regurgitated
- Consent specific to AI use
Governance
- DPIA before high-risk processing
- Data contracts with owners
- Vendor due diligence on data
- Least privilege, encrypted everywhere
Quick exam traps
- Trap: Anonymized training data cannot be re-identified through the model
- Trap: Federated learning removes the need for differential privacy
- Trap: A higher epsilon means stronger privacy
- Trap: Synthetic data carries no privacy risk
- Trap: Encrypting data at rest protects it during training
- Trap: Consent for the original collection covers AI training
- Trap: Deleting a record from the dataset removes it from the trained model
- Trap: Label quality is a data science concern, not a security one
cybercertprep.com · original revision sheet written from the public body of knowledge