Your networking background gives you a solid grasp of securing data in transit. You know that protocols like TLS encrypt data moving between a client and a server, protecting it from eavesdroppers. But what happens when the data reaches its destination and is used to train a machine learning model? The encryption ends, but the security risks don't.

Securing an ML pipeline is fundamentally different. Instead of just protecting data, you're protecting the model's learning process and its decision-making logic. An attacker's goal might not be to steal the data, but to subtly corrupt the model so it makes mistakes on command. This requires a new way of thinking about threats that goes beyond traditional network and software security.

The STRIDE framework is a powerful tool for identifying threats in traditional systems, but it needs an update for the unique challenges of machine learning. AI models introduce new attack surfaces that don't fit neatly into the original categories. To address this, we use an extended framework, often called STRIDE-AI, which maps familiar threat types to their specific manifestations in the ML lifecycle.

This expanded view helps us pinpoint vulnerabilities that are unique to AI. Let's break down two of the most critical threats: those that target the model during its training and those that target it after it's been deployed.

Attacks during the training phase are insidious because they corrupt the model from the inside out. The most common vector is data poisoning.

Imagine a fraud detection model for a financial company. It learns to distinguish legitimate transactions from fraudulent ones by analyzing a massive dataset of past examples. An attacker could poison this process by subtly injecting thousands of carefully crafted fraudulent transactions that are mislabeled as legitimate.

The model, trying to find patterns, learns the wrong lesson. It might conclude that transactions from a certain region, or those with specific characteristics the attacker controls, are always safe. When the attacker later performs real fraudulent transactions with those same characteristics, the compromised model waves them through, blind to the threat it was trained to detect.

Once a model is trained and deployed for inference, it's essentially a black box making predictions. Attacks at this stage don't alter the model itself but exploit its learned patterns to fool it. These are known as evasion attacks.

Consider an autonomous vehicle's camera system, which relies on a model to identify road signs. An attacker could create a sticker with a specific pattern of black and white patches. To a human, it looks like random noise on a stop sign. But to the model, these carefully calculated perturbations are enough to make it classify the stop sign as a 45 mph speed limit sign.

This works because the model hasn't learned to see the world like a human. It has learned a complex statistical function. Evasion attacks exploit the gaps and boundaries in that function to produce a desired wrong answer. Unlike data poisoning, evasion attacks require no access to the training process; they only require the ability to send inputs to the live model.

To build a resilient AI infrastructure, you must identify your core assets and map them to potential threats. The key assets in an ML pipeline are different from a traditional IT system. You're not just protecting servers and databases; you're protecting the intellectual property and integrity of the model itself.

Each asset must be protected with specific controls:

• Datasets: Integrity and confidentiality are paramount. Access controls, data lineage tracking, and anomaly detection can help prevent unauthorized modifications that lead to data poisoning.
• Model Weights: These are the crown jewels. They represent the trained logic of your model. If stolen (model extraction), an attacker can replicate your model or probe it for weaknesses offline. They must be treated as highly sensitive secrets, protected by strict access controls and encryption at rest.
• Compute Resources: Training and inference require significant computational power. These resources must be protected from denial-of-service attacks that could halt business operations or run up massive bills.

By thinking in terms of assets and their failure modes, you can move from a reactive security posture to a proactive one, designing defenses before an attack occurs.

Transitioning from network security to AI security involves shifting focus from protecting the pipes to protecting the logic flowing within them. By applying a threat modeling lens, you can start to see where the real risks lie and build a more robust, resilient ML system.