A permitting team’s CI job promotes a GenAI model artifact to production without verifying a cryptographic signature. What MLSecOps gate is missing?
Select an answer to reveal the explanation.
Short Explanation
Promoting an unsigned model is like accepting a sealed envelope with no city seal — you cannot tell who packed it. Sign and verify before prod. Deleting history, cranking temperature, and Slack shout-outs are not integrity gates.
Full Explanation
A permitting team’s CI job that promotes a GenAI model artifact to production without verifying a cryptographic signature is missing a core MLSecOps gate: model signing and signature verification before production promotion. Signing binds an artifact to a trusted build identity; verification at promote time rejects swapped, rebuilt, or tampered packages that did not come from the approved pipeline. In civic permitting workflows, an unsigned promote path means a malicious or accidental substitute can serve residents without leaving a cryptographic trail that incident responders can trust.
Automatically deleting prior models so only one artifact can exist fails because deleting history removes rollback material and does not authenticate the remaining file. Raising temperature on the new model to improve creativity fails because decoding parameters are not integrity controls and can worsen unsafe generations. Posting the promotion notice only in a public Slack channel fails because notification is not verification; attackers who can promote can also announce.
Exam caveat: treat model signing like container or binary signing in DevSecOps. Awareness messages and parameter tweaks do not substitute for cryptographic admission control at the promotion boundary.
Operational check: require signatures from the city’s approved signing service; fail CI if verification against the trust store fails; retain signed digests with promotion tickets; periodically attempt promote of an intentionally unsigned artifact in a non-prod lane to prove the gate blocks it.