5.3. Securing ML Resources

ML security adds unique threat vectors beyond traditional cloud security. Training data poisoning — injecting malicious examples to corrupt model behavior — has no equivalent in conventional software. Model extraction attacks query production endpoints repeatedly to reverse-engineer the model. Adversarial inputs craft subtly modified data that fools the model while appearing normal to humans. The exam tests whether you understand these ML-specific threats alongside standard AWS security controls like VPC isolation, IAM policies, and KMS encryption.

💡 First Principle: ML systems are uniquely vulnerable because they expose attack surfaces that traditional applications don't have: training data can be poisoned, models can be stolen, and predictions can be manipulated. Security in ML isn't just about access control—it's about protecting the data, the model, and the inference pipeline at every stage.

Without proper ML security, what can go wrong? A misconfigured S3 bucket exposes millions of training records containing PII. An over-permissioned IAM role lets a compromised notebook instance access production databases. A model endpoint without VPC isolation is accessible from the public internet, enabling model extraction attacks. These aren't theoretical—they're compliance violations with real legal consequences.

Think of ML security as three concentric rings. The outer ring is network security—who can reach your resources (VPCs, security groups, network isolation). The middle ring is identity security—who is allowed to do what (IAM roles, policies, least privilege). The inner ring is data security—protecting the data itself regardless of who accesses it (encryption, KMS, data masking). The exam tests all three rings and expects you to know which ring a given scenario requires.

⚠️ Common Misconception: VPC mode and network isolation are the same SageMaker setting. VPC mode places SageMaker resources inside your VPC but still allows outbound internet access via NAT or VPC endpoints. Network isolation (enable_network_isolation=True) is a stricter setting that blocks all network access from the container — no internet, no S3, no CloudWatch. The exam uses this distinction: VPC mode for compliance scenarios that need controlled access to AWS services, network isolation for maximum data protection where model artifacts must be pre-loaded.