Development Pipelines and MLOps Security

GAIPS · 25 questions

• A city MLOps pipeline trains a 311 triage model from a raw ticket export with no scrubbing of resident phone numbers or addresses. What pipeline control should security require first?
• Any county data analyst can edit the Airflow-style DAG that feeds production resident benefit tables into a model training job. What MLOps security gap is most urgent?
• A permitting team’s CI job promotes a GenAI model artifact to production without verifying a cryptographic signature. What MLSecOps gate is missing?
• Housing-authority training workers load community models from pickle files while running with broad operating-system privileges. What risk should the pipeline redesign address?
• Transit MLOps versions datasets but cannot show which source systems produced the features behind a deployed ridership model. What governance capability is missing?
• A public-health training job pulls an unsigned base container image from a public registry during the build. What supply-chain control should MLOps enforce?
• School-district MLOps jobs print cloud training-account API keys into shared CI logs. What control should be applied immediately?
• A water utility’s automated retraining job can swap the SCADA anomaly-detection model in production with no drift check or human approval. What lifecycle control is missing?
• City security wants SAST and secret scanning on repositories that define GenAI prompts and MLOps infrastructure-as-code. What practice does this extend?
• A library ML platform lets analysts publish live endpoints with a notebook “Run All” and no peer review. What separation should MLOps enforce?
• An emergency-management training pipeline caches intermediate datasets on a shared NFS volume with world-readable permissions. What control is most appropriate?
• AppSec discovers a poisoned dependency in a feature-engineering package used across city ML pipelines. What pipeline response best addresses the risk?
• A county benefits model registry allows an engineer to overwrite a production model tag with a new binary. What registry practice should security require?
• 311 feature-store access tokens are long-lived and shared across multiple city teams. What credential practice should replace that pattern?
• A court e-discovery ML pipeline has no quarantine path when malware scanners flag uploaded evidence PDFs. What ingestion control is missing?
• Transit plans a blue/green cutover of a safety-related GenAI assist model but has no automated evaluation suite comparing safety metrics. What MLSecOps step should precede cutover?
• A housing authority shadows production traffic to a candidate model, including sensitive eviction and disability case records. What constraint should MLOps add?
• A city open-data pipeline continuously embeds new documents into a RAG index with no malware or injection scanning on ingest. What job control should be added?
• Public-health MLOps retraining triggers are exposed as unauthenticated webhooks reachable from the internet. What hardening is required?
• Parks computer-vision training shares a GPU queue that lets one project read another project’s training datasets. What cluster control is needed?
• County IT wants model cards and security-review artifacts required before merging GenAI pipeline changes. What kind of gate is this?
• A clerk-automation pipeline serializes “quick demo” models whose metadata fields embed live API keys. What pipeline control should catch this?
• Emergency operations wants a tested rollback when a bad model starts generating false evacuation suggestions. What MLSecOps capability is that?
• Security monitors anomalous training-job data volumes that may indicate someone abusing a civic ML pipeline to exfiltrate datasets. What detection focus is this?
• The city CISO maps MLSecOps controls onto existing SDLC stages for GenAI services rather than inventing a separate unchecked process. What integration goal is this?