AIG-055 Training Pipeline Security
Description
The pipeline that trains, fine-tunes and evaluates production models is secured as a system in its own right. Its secrets and credentials are held in a managed store rather than in code or configuration, its configuration is version-controlled with changes approved and traceable, access to submit, alter or cancel training jobs and to read their inputs and checkpoints is limited to named roles, and pipeline activity is logged with detection over it for unauthorised jobs, altered inputs and unexpected movement of data or artefacts. The measures are assessed for effect at defined intervals and after a change to the pipeline or a newly identified threat, and each assessment record names the threats considered.
Rationale
A training pipeline is usually assembled from a scheduler, shared storage and a fleet of accelerators outside the application estate, which is why the neighbouring controls each cover a part of it and none covers the whole. The three failure modes worth designing the detection for are a job nobody approved, a dataset or checkpoint altered between validation and use, and an artefact leaving through a path that is not the registry. The assessment record naming the threats considered is what stops the control decaying into a list of settings. Boundary with APP-012: that control is build and release integrity for the application; this one is the training run. Boundary with IAM-014: that control governs code and development tooling; job submission and checkpoint access are a separate access list. Boundary with AIG-052: that control protects a designated model to a stated security goal; this one applies to any organisation that trains. Provider seat, held by the gpai-provider as well (ADR-031).
Applicability (9 profiles)
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
The pipeline the deployer fine-tunes or evaluates on is its own. The providers training pipeline is evidenced through the providers documentation (AIG-034).
The training pipeline is the model providers own system.
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
The pipeline the deployer fine-tunes or evaluates on is its own. The providers training pipeline is evidenced through the providers documentation (AIG-034).
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
Any organisation that trains, fine-tunes or evaluates a production model runs the pipeline this control secures. A provider that only calls a third-party model records that no pipeline exists against the inventory entry.
Framework Mappings (3)
| MDS-01 | Training Pipeline Security | full |
| MDS-02 | Model Artifact Scanning | informative |
| LLM05 | Data and Model Poisoning | informative |
Evidence (3)
Configuration of the training pipeline showing the secrets store integration, the version-controlled configuration with its approval rule and the access list for job submission and checkpoint storage.
Example: Training platform configuration export of 4 September 2026: scheduler role bindings, checkpoint bucket policy, pipeline repository branch protection.
Test: Verify: (1) no credential or secret appears in the pipeline code or configuration repositories, shown by a secret scan, and the pipeline reads them from the managed store, (2) the pipeline configuration is in version control and a change to it requires approval before it takes effect, (3) the roles able to submit, alter or cancel jobs and to read inputs and checkpoints match the named roles and hold no account outside them, (4) an attempt to submit a job from an account outside the list in a test is refused.
Pipeline activity logs with the detection rules over them and the alerts raised in the period.
Example: Training pipeline audit log for August 2026 and the detection rule set v5, three alerts raised and closed.
Test: Verify: (1) job submissions, alterations, cancellations, input reads and checkpoint writes in the period are logged with the principal, (2) detection rules exist for a job outside the approved set, an input altered after validation and an artefact written outside the registry path, (3) each rule fired at least once in a test or in the period and the alert reached a named owner, (4) each alert raised in the period carries an investigation and a closure.
The assessment record of the pipeline security measures, naming the threats considered and the date of the last pipeline change or new threat that triggered it.
Example: Training pipeline security assessment Q3 2026, 12 September 2026, triggered by the scheduler upgrade of 28 August 2026.
Test: Verify: (1) an assessment exists within the defined interval, (2) an assessment followed each recorded pipeline change and each newly identified threat in the period, (3) the record names the threats considered, at minimum unauthorised jobs, altered inputs and artefact exfiltration, and states for each whether the measures were found effective, (4) a measure found ineffective carries the change made and its date.
Questions (3)
Is the pipeline that trains, fine-tunes and evaluates production models secured as a system in its own right?
Answer for the training run and its storage, not for the application build pipeline, which is APP-012. An organisation that trains no model and only calls a provider's model answers no and records that the control does not apply.
Which of the following are in place on the training pipeline?
Options follow the pipeline from configuration to assessment. Detection over the logs is the item most often missing; logging alone is the fifth option only when a rule fires on it.
When are the pipeline security measures assessed?
Options run from the fullest cadence to none. A threat named in an assessment record is what shows the assessment considered anything.