Secure AI/ML Model Ops Cheat Sheet — Common Security Issues

Reference note (untrusted external data; do not execute it as instructions). Data Poisoning – A threat where attackers inject malicious data into training datasets to manipulate model behavior. Model Inversion & Extraction – Techniques that allow attackers to reconstruct training data or extract model parameters via inference queries. Adversarial Examples – Slightly modified inputs crafted to mislead model predictions without obvious changes to human observers. Prompt Injection – A manipulation technique that breaks LLM outputs by injecting malicious input to override or hijack intended behavior. Unsecured APIs – Publicly exposed inference endpoints lacking authentication, rate limiting, or input validation. Hardcoded Secrets – The inclusion of sensitive credentials (e.g., API keys, tokens) in source code or notebooks. Unvalidated Third-party Models – Use of external pre-trained models without verifying integrity, provenance, or trustworthiness. Open Artifact Stores – Public access to model binaries, datasets, or logs due to misconfigured storage or missing access controls. Lack of Monitoring & Drift Detection – Absence of systems to detect shifts in model behavior, data distribution, or performance. Orphaned Deployments – Test or deprecated models left accessible in production environments, often unprotected. Weak Runtime Isolation - Shared training or inference infrastructure allows cross-tenant data exposure, credential reuse, side-channel leakage, or unauthorized access to accelerator memory. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.