MLOps Under Attack: Threat Modeling Modern AI Systems
summary
MLOps pipelines use Jupyter, Hugging Face, MLflow, Kubeflow, KServe, Seldon and cloud stacks (SageMaker, Vertex) and the talk shows concrete failures: public research discloses ~10–20 CVEs across platforms and MLflow reports nine critical issues in 2024, attackers exploit pickle-based code execution in downloaded models, leverage overly-permissive IAM from quick-start scripts, and escape weakly isolated containers to access other tenants. The recommended builds are model registries, signed commits, provenance-tracked data stores and strict segmentation to stop model registry abuse.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:11MLOps lifecycle overview
- 6:05MLOps tooling and platforms
- 14:44LLM Ops and modern AI stacks
- 17:36Attack scenarios in MLOps
- 21:51Supply chain and platform risks
- 25:27Model file format vulnerabilities
- 27:56Bug hunting in MLOps
- 31:26CVEs in MLOps platforms
- 32:52Building secure MLOps systems
- 36:04Secure architecture example
- 40:16Takeaways and tabletop scenarios
related talks
50mBuilding AI Security In: MLSecOps in Practice
26mRunning Secure AI/ML Experiment in a Unified MLOPS-DevSecOps Pipeline
43mHacking and Securing ML Systems and Environments
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...
53mSecurity of Machine Learning Systems
30mOwned by Statistics: Using Kubeflow to Defend vs Attacks on Your ML Models
45mThreat Modeling in the Age of AI
34mThe State of AI and Machine Learning Operations in 2019