End-to-end secure ML Development
summary
Demonstrates concrete defenses: Sigstore short-lived signatures for gigabyte‑scale models, a model‑signing library that hashes checkpoints deterministically, and outputting SLSA provenance via GitHub Actions so a model links back to commits. Explains the pickle→safe-tensors conversion exploit that allowed malware injection, shows tracing a bad production inference back to a poisoned training input, and describes an blast‑radius retrain minimization approach plus an AI/ML control plane and package manager that reduce unnecessary retrains.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:51AI security risks
- 5:48Malware in models
- 8:15AI attack expansion
- 10:04ML pipeline overview
- 13:13Model integrity concerns
- 14:15Signing models securely
- 17:46Challenges in model signing
- 18:07Protecting the chain
- 20:13Conclusion and resources
related talks
23mEnd-to-End Secure ML Development
19mWe Know Security but How Do We Secure GenAI End-to-End?
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...
26mRunning Secure AI/ML Experiment in a Unified MLOPS-DevSecOps Pipeline
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges
53mSecurity of Machine Learning Systems
19mModel transparency for AI/ML security
25mSecure ML: Automated Security Best Practices in Machine Learning