AAISM · Topic 5
AI Infrastructure Security
Domain: AI Technologies and Controls, about 38% of the exam
The ML platform stack
- Data ingest
- Feature store
- Training cluster
- Experiment tracking
- Model registry
- Serving endpoint
- Monitoring
- Ingest
- source auth, checksums, schema validation
- Training
- GPU isolation, raw data access
- Tracking
- logs leak hyperparameters and samples
- Registry
- signed, versioned, access controlled
- Serving
- public surface, rate limited
- Artifacts in transit
- TLS, hashing, signing between stages
- Documentation
- diagrams, data flows, access matrices
Training and inference have different risk profiles: separate them at network, identity and cluster level
GPU cluster isolation
- Shared GPU memory leaks between tenants
- Side channels on shared accelerators
- Namespaces and quotas per team
- Network segmentation between jobs
- Distributed training replicates data widely
- Gradient traffic between nodes encrypted
- Cooling and power are attack surfaces
Secrets and keys
- Central secrets manager, never in code
- Just-in-time injection into jobs
- Automatic rotation with audit logging
- Notebooks are a common leak path
- HSM-backed keys sign model artifacts
- Short-lived tokens for model APIs
- Scan repositories and images for secrets
Containers and Kubernetes for ML
- Base images
- minimal, scanned, pinned digests
- Privileged pods
- GPU access tempts, restrict it
- Pod security
- non-root, read-only root filesystem
- Network policies
- deny by default between namespaces
- Admission control
- only signed images deploy
- RBAC
- least privilege service accounts
- Node isolation
- dedicated GPU node pools
MLOps pipeline security
- Code injection in training scripts
- Poisoning through compromised ingest stage
- Artifact tampering between stages
- Sign artifacts, verify before promotion
- Infrastructure as code, reviewed and versioned
- Separate duties: build, approve, deploy
- Reproducible builds detect silent drift
Inference endpoint protection
Threats
- Extraction through systematic queries
- Denial of wallet from unbounded prompts
- Prompt injection through the API
- Data exfiltration in responses
- Credential theft for paid APIs
Controls
- Authentication and per-client quotas
- Rate limiting and token budgets
- Query pattern anomaly detection
- Output filtering and truncation
- Gateway in front of every model
Design rules
- No direct internet to model pods
- Separate tenants at gateway and index
- Timeouts and size limits everywhere
- Fail closed when guardrails are down
Logging without leaking
- Log model version, timestamps, decision metadata
- Redact or hash prompts containing PII
- Store full prompts only under legal need
- Access to logs is itself privileged
- Regulated sectors log every decision
- Retention schedule matches data class
- Logs feed drift and abuse detection
AI-specific indicators of compromise
- Unexpected accuracy shifts without code change
- Anomalous training data distributions
- Unauthorized model deployments or versions
- Large outbound transfers from training nodes
- Odd inter-node traffic patterns
- Grid-like query sweeps on endpoints
- Unusual GPU utilization off schedule
Cloud shared responsibility
- Provider
- hardware, hypervisor, physical, base services
- Customer
- data, identities, configuration, prompts
- Managed model API
- provider runs model, you own inputs
- Fine-tuning data
- customer vets, always
- Data residency
- region pinning, training opt-out
- Contract
- no training on your data clause
- Attestations
- SOC 2, ISO 27001, AI addenda
Resilience and testing
- Security chaos engineering injects attacks
- Fallback model or rules engine ready
- Rollback tested, not assumed
- Backups of weights and registries
- Training checkpoints protected like models
- Maturity: ad hoc, managed, defined, optimized
Compliance ties
- GDPR and HIPAA demand technical measures
- EU AI Act requires logging and robustness
- ISO 27001 controls extend to ML hosts
- Audit evidence: diagrams, baselines, logs
- Incident plan covers model compromise
- Documentation kept current with changes
Key terms
- HSM
- tamper-resistant signing keys
- Admission controller
- policy gate for Kubernetes deploys
- Feature store
- shared, governed model inputs
- Model registry
- versioned artifact catalog
- Denial of wallet
- cost exhaustion through consumption
- Side channel
- leak via shared hardware
- IaC
- infrastructure defined in code
Reference strip: isolation, secrets, pipeline, endpoint, logging
Isolation
- Dedicated GPU pools per tenant
- Training apart from inference
- Deny-by-default network policies
- Encrypt inter-node gradients
Secrets
- Secrets manager, JIT injection
- Rotate and audit automatically
- HSM for signing keys
- Scan notebooks and images
Pipeline
- Sign and verify every artifact
- TLS and hashes between stages
- Separate build, approve, deploy
- Only signed images admitted
Endpoint
- Auth, quotas, rate limits
- Detect grid-pattern queries
- Gateway fronts every model
- Fail closed without guardrails
Logging
- Metadata always, prompts redacted
- Log access is privileged
- Watch AI-specific IoCs
- Retention by data class
Quick exam traps
- Trap: Standard IT hardening fully covers GPU training clusters
- Trap: Logging every full prompt is always the safest choice
- Trap: A managed model API shifts responsibility for input data to the provider
- Trap: Rate limiting alone prevents model extraction
- Trap: Training and inference workloads can share a cluster because they use the same model
- Trap: Experiment tracking logs are low sensitivity
- Trap: Container image scanning replaces signing and admission control
- Trap: Model rollback works if the previous artifact still exists
cybercertprep.com · original revision sheet written from the public body of knowledge