AI Security
Advanced 13 min read AI Security

Secure Deployment

Standards, extended to AI stacks

Deployment security for AI: secrets outside reach, network egress controlled, models served from pinned artifacts, and the pipeline scanned. The model doesn't change your deployment discipline — it extends it.

deploymentsecretsegressartifact integritysbomsupply chain
Prerequisites: Data Leakage
Before we start

What you will learn

  • Protect provider secrets end-to-end
  • Control network egress from AI services
  • Lock model and dependency artifacts
Introduction

What is this?

Secure deployment brings classic supply-chain and runtime security to AI: API keys in secrets managers (never env-visible to the model or tools), egress allowlists for model providers, pinned and integrity-checked model/serving artifacts, dependency SBOM scanning, and least-privilege service accounts for calls.

Motivation

Why do you need it?

  • Compromised keys = free compute and data access.
  • Pinned artifacts prevent tampered models or SDKs.
  • Egress control limits exfiltration by any injected flow.
  • AI adds attack surface without exempting you from standards.
Think about it

Mental model

Imagine

A bank vault's loading dock

Think of

Secure deployment

Money (secrets) enters via a certified armored van (secrets manager), cargo is scanned and logged (SBOM), only authorized doors open (egress), and every crate is integrity-locked (signatures). The AI model is another crate on that dock — locked, logged, and route-confined like everything else.

Mechanics

How it works

  • Secrets → secrets manager; injected at runtime only.
  • Serving/model artifacts: pinned hashes + signed releases.
  • Egress: allowlist provider endpoints only.
  • SBOM + dependency scanning in CI.
  • Least-privilege IAM: model calls can't reach everything.

Deployment locks.

Secrets
Artifacts
Egress
Identity
Scan
Real world

In production

  • Serverless functions fetch provider keys from the secrets store.
  • Model artifacts pulled from a registry with hash pinning.
  • Egress firewalls allow only the LLM provider endpoint.
Guidelines

Best practices

  • Nothing secret ever enters model-visible context (keys, tokens).
  • Pin SDK and model versions with integrity checks.
  • Allowlist egress; deny by default.
  • Scan dependencies and the serving image in CI.
Watch out

Common mistakes

  • API keys in env vars visible to executor tools.
  • Bleeding-edge unpinned model artifacts (unreviewed updates).
  • Open egress 'to be safe' (defeats containment).
Root cause analysis

Common issues

Error
Secret exposed in a trace/log
Root cause

Env or headers leaked

Fix

Redact in middleware; never log request headers wholesale.

Error
Tampered artifact loads
Root cause

No pin

Fix

Pin hashes in CI; block non-conforming pulls.

When things break

Debugging tips

  • A tool reads env → it can see vars; scope service identity tighter.
  • Update drift → pin versions; audit upgrade paths.
  • Egress blocked legitimately → review + allowlist conversation, don't open all.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Provider secrets belong in…

2

Model artifacts should be pinned and integrity-checked.

Go deeper

Official documentation

OWASP Secure Deployment
docs