AI Model Lifecycle Security and MLOps
Domain 6 tests secure model lifecycle and MLOps: how to build, train, test, deploy, monitor, and retire models without weakening controls. Expect pipeline-design and artifact-integrity questions.
Core rules and concepts
- Maintain a model inventory with owner, purpose, risk tier, data sources, dependencies, and deployment locations.
- Version data, code, hyperparameters, prompts, and evaluation sets. Reproducibility is a security control because it enables rollback and forensics.
- Secure the pipeline: least-privilege CI/CD identities, isolated training environments, approved base images, dependency scanning, secrets management, and signed artifacts.
- Use evaluation gates before release: security testing, adversarial testing, bias/fairness checks, privacy tests, and performance thresholds. A failed gate blocks promotion.
- Produce and maintain an ML-BOM/SBOM and model card. Verify model provenance and integrity at deployment.
- Monitor drift, behavior change, and abuse after release; define rollback and decommissioning procedures.
Worked example
A team fine-tunes a vendor base model on customer support transcripts. The pipeline pulls data from a warehouse, trains in an isolated job, stores the model in a registry, and deploys via CI/CD. The exam wants controls at each stage: data classification and lineage before training; dataset approval; signed training image; artifact hash recorded; model scanned for secrets and tested for memorization; deployment gated by evaluation; prompt and model version pinned; rollback to the prior signed artifact if drift or incident occurs. The key is that provenance and rollback are designed in, not improvised.
Traps that cost marks
- Versioning code but not data, prompts, or evaluation sets.
- Treating the model registry as a backup rather than a controlled artifact store.
- Allowing CI/CD identities broad cloud permissions.
- Skipping post-deployment drift and abuse monitoring.
- No decommissioning plan for retired models and data.