ML Infrastructure and Model Supply Chain
Jupyter, MLflow tracking servers, GPU nodes and schedulers, MLOps trust boundaries and model weights that are also executable software.
Machine learning infrastructure is ordinary infrastructure with unusual defaults: notebooks with execution, registries with credentials, and artifacts that deserialize.
Jupyter
A notebook is both a document and an execution console. Anyone reaching the interface often gains the security context of the user who started the kernel. Jupyter Server creates sessions, kernels and access tokens. A kernel executes Python or another language with the permissions of the local process. Saved notebooks may contain secrets, outputs and paths. Extensions and terminals expand the surface. I inspect authentication, token exposure, origin handling, terminals, active kernels and accessible filesystem before executing code. A password or token protects the interface, but bad reverse-proxy configuration and tokenized URLs in history or logs may expose the session.
1
2
jupyter server list
curl -s http://127.0.0.1:8888/api/kernels -H 'Authorization: token <lab-token>'
MLflow
MLflow stores more than metrics. Depending on the workflow it moves artifacts, models, storage credentials and loadable code. MLflow Tracking exposes experiments, runs, artifacts and model registry. Backend and artifact stores may use different credentials. Model flavors and pyfunc may load Python and serialized objects. Controlled artifact uploads become risky when another job trusts and loads the content. I map tracking URI, authentication, artifact URI, registry permissions and who can create versions or change aliases and stages. RCE may occur in the consumer rather than the tracking server. The report needs to show which process loads the artifact and under which identity.
1
2
mlflow artifacts list -u 'runs:/<run-id>/'
curl -s https://mlflow.example.test/api/2.0/mlflow/experiments/search
MLOps Security
An ML pipeline can execute code, download artifacts and access cloud services just as easily as a software pipeline. MLOps connects notebooks, feature stores, registries, training jobs, artifact stores and deployment. Every transition carries identity and data. Model registries, dataset sources and pipeline definitions form a supply chain. A replaced artifact may reach runtime without a classic API vulnerability. I map producer, storage, registry, consumer and credentials used at each stage before testing upload or replacement. Model security without pipeline security covers little. Provenance, signing, access control and job isolation need to work together.
1
dataset -> training job -> artifact store -> model registry -> serving runtime
ML Infrastructure
ML clusters often combine expensive hardware, sensitive data and cloud credentials in one place. That makes the infrastructure a natural target. ML infrastructure uses schedulers, GPU workers, notebooks, shared storage, container registries and orchestration. Shared datasets, NFS, Docker sockets, SSH keys and cloud metadata connect one job to resources beyond its own container. I start with tenant boundaries, scheduler identity, mounts and secrets available to a job. GPU and driver isolation also depends on the host. Container security remains relevant to ML workloads.
1
2
3
nvidia-smi
mount
env | grep -E 'AWS|AZURE|GOOGLE|TOKEN|KEY'
AI Model Supply Chain and Model Hubs
Downloading a model from a hub may bring weights, configuration, custom code and serialized files. Not everything is passive data. Model hubs distribute checkpoints, tokenizers, configs and sometimes code that frameworks load with explicit trust flags. Pickle-based formats and remote custom code create execution paths in ML environments. Typosquatting and account takeover also affect the supply chain. I verify publisher, commit, file types, signing or provenance and whether the loader enables options such as trust_remote_code. Safetensors reduces code-execution risk in weight serialization but does not fix custom Python or dependency compromise around the model.
1
2
find model-dir -maxdepth 2 -type f -printf '%f\n' | sort
grep -R 'trust_remote_code' -n .