Question

A financial firm deploys machine-learning models into production through an automated MLOps pipeline. A recent incident revealed that an attacker with access to the shared model registry replaced a fraud-detection model binary with a modified version, and the pipeline promoted it to production without detecting the swap. The security team must ensure that only authentic, unmodified model artifacts produced by the approved training pipeline can be deployed. Which control most directly addresses this gap?

Accepted Answer

Cryptographically sign model artifacts at the end of the training pipeline and require deployment tooling to verify the signature and provenance metadata before promotion

Answer

Encrypt the model registry storage at rest using an HSM-backed key and restrict decryption to the deployment service account

Answer

Add adversarial-input detection at the inference API to flag anomalous prediction requests against the fraud model

Answer

Enable membership-inference protections and differential privacy during model training to reduce data leakage