New research from Security Intelligence – based on a whitepaper published by IBM – shines the spotlight on potential vulnerabilites and attack scenarios that can be conducted on popular MLOps platforms such as Azure Machine Learning (Azure ML), BigML and Google Cloud Vertex AI.

As businesses rapidly adopt machine learning (ML) technologies to drive innovation and operational efficiency, machine learning operations (MLOps) platforms have become critical for managing the lifecycle of ML models. However, the increasing reliance on these platforms has also made them prime targets for cyber-attacks.

The research highlights the methods attackers use to infiltrate MLOps environments, the attack scenarios they deploy, and actionable steps to bolster security and detection.

The How

Cyber-criminals often gain access to MLOps platforms by obtaining valid credentials through tactics such as social engineering, exploiting misconfigured internal networks, or compromising file shares and user workstations. Once inside, attackers can exploit vulnerabilities to disrupt operations, steal sensitive data, and compromise deployed models.

1. Data Poisoning
Attackers can target the “Design” phase of the MLOps lifecycle by introducing malicious data into training datasets. This manipulation compromises the training process, influencing the ML model to produce flawed or biased results. Such poisoned models can lead to significant operational risks when deployed in production.

2. Data Extraction
By gaining access to training datasets, attackers can extract sensitive information, including personally identifiable information (PII), protected health information (PHI), or even proprietary business data. These stolen datasets can be used to train unauthorised models or enable further cyber-attacks. For instance, models used as coding assistants may inadvertently expose sensitive credentials during training.

3. Model Extraction
Model theft allows attackers to replicate trained ML models, either before or after deployment. A stolen model may reveal critical training data, such as weights and biases, or provide predictive capabilities that attackers can exploit for financial gain. For example, an attacker might use a stolen model trained to predict stock or commodity prices for insider trading or other malicious purposes.

4. Evasion Attacks
These attacks focus on deceiving deployed ML models into misclassifying inputs. A common example is bypassing spam filters by crafting emails designed to evade detection. This tactic undermines the reliability of ML-powered systems, such as cybersecurity solutions.

5. Code Execution Attacks
Attackers can modify ML models to embed malicious code, which is then executed when the model is loaded. This can compromise not just the MLOps platform but also the broader systems connected to it, creating widespread vulnerabilities.

The Attack Path: From Credentials to Exploitation

The research outlines how attackers, using stolen credentials, can perform reconnaissance to identify available datasets and models. Once identified, they can deploy tools such as “download-dataset” or “download-model” modules to extract this information.

For instance, in the BigML platform, attackers can download datasets and models to their working directories, mimicking the structure of files stored in cloud services like Google Cloud.

Defensive Considerations

To mitigate these threats, the research emphasises the importance of securing MLOps platforms through robust configuration practices and detection mechanisms.

Azure ML
To secure Azure ML, organisations should implement role-based access controls to ensure that only authorised users have access to critical resources. Network isolation should also be enforced to minimise exposure to potential threats. Additionally, encrypting data both at rest and in transit protects sensitive information from unauthorised access.

To enhance security further, regular container vulnerability scans should be conducted, and Azure Policy governance tools should be utilised. Finally, organisations must regularly audit ML assets, including models, datasets, and endpoints, to maintain a secure environment.

BigML
For BigML, enabling multi-factor authentication (MFA) is essential to add an extra layer of security. Credentials, including API keys, should be rotated frequently to reduce the risk of misuse. Applying fine-grained access controls ensures that resource access is restricted based on user roles, limiting unnecessary exposure to sensitive data or functionality.

Recommended

• AI Images Outperform Real Images in ML Training
• AI Adoption: Leaders Are Excited, Employees Stay Hesitant
• Gartner: AI Driving Trends in Data Science and ML

Vertex AI
Securing Vertex AI starts with enforcing the principle of least privilege for both users and service accounts, ensuring access is granted only as needed. External IP addresses should be disabled, and Virtual Private Cloud (VPC) service controls should be enabled to strengthen network security. Organisations should also enable audit logging to detect and respond to anomalous activity. Additionally, leveraging the Security Command Center allows businesses to monitor and enhance the security of Vertex AI applications effectively.

Detection and Monitoring

Organisations must build strong detection mechanisms to identify potential attacks, including:

• Recognising unauthorised access to datasets and models.
• Monitoring for abnormal requests against published models.
• Detecting attempts to exfiltrate training datasets or manipulate ML workflows.

As AI and ML technologies become indispensable to business operations, MLOps platforms are increasingly targeted by cybercriminals. Attacks like data poisoning, extraction, and model theft not only threaten operational continuity but also expose sensitive data and intellectual property to misuse.

By implementing stringent security practices, adopting advanced detection mechanisms, and conducting regular threat modeling exercises, businesses can protect their AI-driven innovations.

The whitepaper accompanying the research delves deeper into the technical details, offering a comprehensive guide to securing MLOps platforms and mitigating risks.