Establishing a robust security baseline for the MLOps pipeline involves several cross- functional responsibilities. An AI Security Architect is…

The question asks for priority actions to secure the MLOps pipeline against supply chain attacks.

A. Enforce Multi-Factor Authentication for model registry access: A model registry is a critical component of the MLOps supply chain, storing trained models. A supply chain attack could involve an attacker gaining unauthorized access to this registry to poison a model or steal intellectual property. Enforcing MFA is a fundamental access control measure that significantly hardens this component against unauthorized access.

D. Implement Signed Container Images for ML training environments: ML development and training environments, such as Jupyter notebooks, are often deployed as container images. A supply chain attack can compromise these base images, injecting malicious code that could steal data or compromise the training process. Signing container images provides a cryptographic guarantee of their authenticity and integrity, ensuring that only trusted, verified images are used in the CI/CD pipeline.

B. Perform Feature Engineering to improve Model F1-scores: This is a data science task focused on improving model performance and accuracy, not securing the underlying infrastructure from supply chain attacks.

C. Label Large Data Sets for supervised learning tasks: This is a data preparation step. While the integrity of the data labeling process is important, the act of labeling itself is not a direct security control against attacks on the CI/CD pipeline or software dependencies.

E. Manage Hyperparameter Tuning via automated grid search: This is a model optimization technique used to find the best model configuration. It is related to model performance, not the security of the MLOps infrastructure.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1. The framework emphasizes securing all components of the AI lifecycle, stating that "AI systems are subject to the same vulnerabilities as other software systems, as well as new, AI-specific vulnerabilities." Securing artifacts (models, data, code) and the development environment is a core tenet. (Section 4.2, "Govern").

2. Google Cloud Documentation. Securing your software supply chain. This documentation outlines best practices for securing CI/CD pipelines, including the use of artifact verification. "Software supply chain security is about ensuring the integrity of the software you use... Binary Authorization for Borg (BAB) enforces that production software is properly reviewed and authorized." Signing images is a key part of this verification. (Section: "Verifying artifacts").

3. OWASP. Machine Learning Security Top 10. M08-2023: AI Supply Chain Compromise. This risk category explicitly covers attacks on components used to build the ML system, including development environments and third-party dependencies. Recommended mitigations include "Verify software signatures and use lock files for all third-party libraries" and "Implement strong access controls for all components of the ML pipeline."