AI
The Expanded Attack Surface in ML Systems
Traditional software security targets code, containers, and configurations. ML systems expand that surface significantly. Training data can be poisoned. Model weights can be stolen or tampered. Pipelines that retrain continuously introduce new risks with every cycle. Inference endpoints exposed to adversarial inputs can be fooled. The speakers co-authored a white paper on this with Dell, Ericsson, and the OpenSSF AI/ML working group, and MLSecOps is their answer: DevSecOps principles extended to cover the full ML lifecycle.
A Nine-Stage Reference Architecture
The paper maps the ML infinity loop onto nine pipeline stages, from planning and design through monitoring. Three domains organize these stages: planning, experimentation and development, and staging and operation. Yellow boxes mark manual processes; blue boxes mark automated pipeline steps. Artifacts (datasets, pipeline code, model weights, metadata) flow between stages. Every handoff is a control point. An MLOps process without security controls becomes a fast path from data ingestion to a compromised model in production.
Personas and Shared Responsibility
MLSecOps is not primarily a technology problem. Data scientists, data engineers, security practitioners, software developers, and MLOps engineers all hold security responsibilities at specific stages. The paper extends classic OpenSSF personas to add ML-specific roles: the MLOps engineer owns CI/CD and continuous training pipelines, while the security practitioner appears at every stage. That cross-cutting role means the security practitioner must actively brief each team member on what they need to protect, not just audit systems after the fact.
OWASP ML Top 10 Across the Pipeline
The paper uses OWASP ML Top 10 as its threat baseline, mapped to each architecture stage. The design phase covers input manipulation and model poisoning. Data engineering stages face data poisoning and supply chain risks. The model serving stage shows the highest threat density: model theft, membership inference, and adversarial inputs all concentrate there. Supply chain risks appear at almost every stage, making provenance tracking non-optional. The opacity of ML systems (black-box execution, unknown training data lineage) makes early security controls more important, not less.
OpenSSF Tools for Supply Chain Coverage
The paper targets four outcomes: integrity, provenance, repo hygiene, and traceability. Sigstore signs and verifies model artifacts, not just container images. SLSA provides provenance attestations showing how something was built and its dependencies. Scorecard and Allstar harden repositories before untrusted code enters the pipeline. GUAC connects artifact and dependency graphs so a compromised data source can be traced to every model that needs retraining. Most of these tools target software supply chains and still need extension for ML-specific artifacts like model weights and training data provenance.
Notable Quotes
secops is now one control or one tool. Bahaulddin Shammary · ▶ 25:03
this is a point where your model is exposed Andrey Shorov · ▶ 17:28
cannot rely on manual reviews. It’s just not feasible. Andrey Shorov · ▶ 26:40
Key Takeaways
- Supply chain risks appear at nearly every ML pipeline stage, making provenance tracking non-optional.
- The model serving stage concentrates the most threats; adversaries actively probe exposed inference endpoints.
- Continuous retraining pipelines cannot be secured through manual review alone; automation is required.
- MLSecOps supplements existing security programs rather than replacing them; shared responsibility across all team roles is the baseline.
About the Speaker(s)
Bahaulddin Shammary is an AI Lead Engineer at OpenText with more than 7 years building agentic AI systems, RAG pipelines, and secure MLOps architectures. His prior roles include Dell Technologies and Quest Software. He is a published researcher in NLP and AI security and a co-inventor of patents in AI.
Andrey Shorov is a cybersecurity professional with more than 16 years of experience, holding a Ph.D. in Computer Science and certifications including CISSP and Security+. His work at Ericsson focuses on AI/ML security, cloud computing, and telecom security.