Secure Deployment
Threats: Supply Chain (LLM05), Model Extraction (LLM10), Data Poisoning (LLM03), Adversarial Inputs (LLM01)
Standards: NIST AI 600-1 §2.12; OWASP LLM05/LLM10; EU AI Act Art. 25/Art. 53/Art. 55; ISO 42001 A.3.3/A.5.3/A.6.2/A.8.1; SLSA v1.0; MITRE TA0002/TA0004/TA0013
Trusted Execution Environments (TEEs)
| TEE Type | Use Case | Attestation |
|---|---|---|
| Intel SGX / TDX | Single-model inference, key management | Remote attestation (Intel DCAP); quote verification |
| AMD SEV-SNP | Full VM isolation; multi-model serving | SNP attestation; firmware measurement |
| NVIDIA H100 CC | GPU-accelerated confidential inference | GPU attestation; NVLink encryption |
| AWS Nitro / Azure Confidential / GCP C3 | Managed confidential VMs | Cloud provider attestation service |
Deployment pattern:
Client → TLS → TEE Gateway → Attestation → Model in Enclave → Response
↑
Verifier checks:
- Measurement hash matches expected
- TCB version approved
- Signing key authorised
Model Signing & Verification
| Stage | Artifact | Signature | Verification |
|---|---|---|---|
| Training output | model.safetensors |
Author key (cosign/notation) | CI/CD gate |
| Quantised/Compiled | model.onnx / model.engine |
Build service key | Admission controller |
| Container image | inference:v1.2.3 |
Cosign keyless (OIDC) | Kyverno / Ratify |
| Deployment | Helm chart / K8s manifest | Git commit sig + SLSA provenance | Policy controller |
SLSA Level 3+ recommended for production models.
Confidential Computing Architecture
Rendering diagram...
Key properties:
- Model weights never in host memory (encrypted in transit to enclave)
- Prompt/response encrypted end-to-end (client ↔ enclave)
- Attestation verifies: code hash, model hash, TCB version, no debugger attached
Supply-Chain Verification Gates
| Gate | Check | Tooling |
|---|---|---|
| Pre-merge | Unit tests, SAST, dependency scan | GitHub Actions, CodeQL, Trivy |
| Build | Hermetic build; SLSA provenance | Bazel/Nix, slsa-github-generator |
| Registry | Cosign signature + SBOM (Syft) | cosign, syft, oras |
| Admission | Verify sig + SBOM + SLSA level ≥ 3 | Kyverno, Ratify, Gatekeeper |
| Runtime | Periodic hash verification of loaded weights | Sidecar / eBPF probe |
Zero-Trust Inference Network
| Principle | Implementation |
|---|---|
| Never trust, always verify | mTLS everywhere (spiffe/spire); workload identity |
| Least privilege | Each model replica: dedicated SA, scoped token, no host access |
| Micro-segmentation | Network policies: client → gateway → enclave only |
| Continuous verification | Periodic re-attestation (hourly); revocation on policy change |
Citation Register
| Control | Standard | Provision | URL |
|---|---|---|---|
| TEE deployment | NIST AI 600-1 | §2.12 | https://doi.org/10.6028/NIST.AI.600-1 |
| Supply chain | OWASP LLM Top 10 | LLM05 | https://owasp.org/www-project-top-10-for-large-language-model-applications/ |
| Model theft | OWASP LLM Top 10 | LLM10 | https://owasp.org/www-project-top-10-for-large-language-model-applications/ |
| Provider obligations | EU AI Act | Art. 25, Art. 53 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj |
| Systemic risk GPAI | EU AI Act | Art. 55 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj |
| Asset management | ISO 42001 | A.3.3, A.5.3, A.6.2, A.8.1 | https://www.iso.org/standard/81230.html |
| SLSA levels | SLSA Framework | v1.0 Level 3+ | https://slsa.dev/spec/v1.0/levels |
| Resource development | MITRE ATLAS | TA0002 | https://atlas.mitre.org/tactics/TA0002 |
| ML model access | MITRE ATLAS | TA0004 | https://atlas.mitre.org/tactics/TA0004 |
| Exfiltration | MITRE ATLAS | TA0013 | https://atlas.mitre.org/tactics/TA0013 |