What is Machine Learning Operations (MLOps)?
Machine learning models provide valuable business insights, but only if you can give them continuous access to high quality data. Machine Learning Operations (MLOps) is a key process for achieving this. It is a similar concept to continuous integration and continuous delivery (CI/CD) in the software development world.
MLOps is a cross-functional, collaborative, iterative process for data science projects. MLOps does this by treating machine learning (ML) models as reusable software artifacts. Models can then be deployed and continuously monitored through a repeatable process.
MLOps supports continuous model integration and rapid, repeatable deployment. As a result, businesses can more quickly discover valuable information and insights from their data. MLOps also supports continuous monitoring and retraining of models in production to ensure they perform optimally as data drifts over time.
Types of ML Cyber Threats
There are four main categories of cyber threats that face ML models-poisoning, input attacks and evasion, reverse engineering, and backdoor attacks. Threat actors can use any of these categories to infiltrate machine learning systems.
Poisoning
Threat actors use a poisoning attack to compromise an artificial intelligence (AI) model. It can occur at any stage, including training, deployment, and real-time inference, but more common during training and inference. Here are three common ways threat actors implement poisoning:
- Dataset poisoning-occurs when a threat actor manipulates a training dataset, which contains the information the model is trained on. The actor infiltrates the training dataset and introduces incorrect or wrongly labeled data into the dataset, distorting the entire learning process. In addition to directly poisoning a mode, threat actors can poison it during the data collection and curation phases.
- Algorithm poisoning-occurs when a threat actor manipulates the algorithm used to train a model. For example, threat actors can inject hyperparameters into the algorithm, change the algorithm’s architecture, or manipulate a subset of training data to influence the final resulting model.
- Model poisoning-occurs when a threat actor replaces a deployed model with another model that serves the attacker’s purposes.
Input Attack and Evasion
This attack occurs when a threat actor modifies input to the ML system and causes it to give a wrong prediction or malfunction. These changes can be subtle or small, making them difficult to detect.
Threat actors often launch input attacks against computer vision algorithms, making small changes to manipulate the prediction, causing the system to take wrong actions. For example, changing pixels in the input image can cause the system to make a wrong prediction.
Reverse Engineering
An AI system can be a black box or understandable. The term black box applies to AI systems that accept inputs to generate outputs but do not explain how logic or algorithm behind the output. Training datasets are also kept confidential in most cases.
This confidentiality can make it impossible to understand why the AI generates certain outputs or how the algorithm, logic, or training data work. However, some systems can be reverse-engineered. In this attack, the threat actor attempt to replicate the original model and use it to their advantage.
Backdoor Attacks
This attack enables threat actors to embed patterns in the model during training or inference stages. The actor infers the model using pre-curated inputs to trigger the ML system or produce unexpected outputs. A backdoor attack can occur in the training and inference phases, while evasion and poisoning attacks can occur in one phase during training or inference.
Layers of MLOps Security
Data Security
You need a privacy policy to help you plan to restrict user access. It is also important to clearly map out your datasets and understand which data is sensitive. Knowing what data resides in the secure environment of MLOps and how it can be accessed and protected will avoid security and compliance issues. There are several ways to secure data, including encryption, hashing/tokenization, data masking, and anonymization.
Data Storage
Data stores that hold large datasets are vulnerable to attacks by hackers, cybercriminals, organized crime groups, and competitors involved in industrial espionage. Safeguarding data storage requires:
- Physical controls including monitoring facilities with temperature and smoke sensors, prevent unauthorized access with biometric or other physical access controls, and maintaining CCTV monitoring with video retention.
- Technical controls-access control and user authentication for secure access to legitimate users, with careful monitoring of data transfer and data access patterns, extensive logging, and analysis of suspicious behavior.
- Administrative controls-include data retention and protection policies, including storage considerations in security policies, ensuring the end-to-end infrastructure is compliant, and handling destruction of data that is no longer needed.
Model Creation
The foundation for many machine learning model architectures already exists, and most companies use existing pre-trained models or data mining algorithms as a starting point, instead of starting from scratch. fine tuning. When building models, best practices should include using only official GitHub repositories of algorithms and models owned by academic authors or institutions, or whitelisted repositories validated by their respective organizations.
It is critical to reexamine the security aspects and implications of your model design decisions. A potential solution should be rigorously evaluated from a security standpoint, before selecting a final model for a production project. This is an iterative process that can might require re-evaluation of certain assumptions made during the design phase.
At this stage, security stakeholders should identify potential vulnerabilities, by evaluating pre-trained models that are published externally; identify whitelisted public repositories that can be used for pre-trained models; and define risk scores for models, enforcing acceptable risk levels. In addition, they should provide tools and audit processes to reduce the risk of using insecure models, identifying aspects like data integrity, interpretability, and robustness.
Logging and Monitoring MLOps Infrastructure
After a model has been developed and successfully deployed to production, the next step is to monitor the model’s performance and tune or retrain it if performance does not meet expectations.
When this happens, ML engineers rely on multiple infrastructure and services, each of which provides different metrics and logs, to check model performance. They can use this data to understand what is wrong and improve the model-this is called continuous monitoring.
