Baseline Security Controls: Deploy
The deploy phase operationalizes the trained models for production. During this phase, the AI system and its associated artifacts are packaged, validated, and prepared for integration into applications, workflows, or downstream systems. This section focuses on controls that safeguard the most valuable fundamental computational assets of an AI system—the model artifacts themselves, including model weights, architectures, learned representations, and supporting metadata. Protecting or restricting access to these artifacts, validating the inputs used for training, verifying their integrity, and hardening systems against adversarial manipulation are necessary to maintain AI system security and integrity.
For internal or restricted models, strong access controls and strict authentication are critical. Use strong authentication, role-based permissions, encrypted storage, audit logging, and continuous monitoring to reduce the risk of unauthorized access, use, or extraction.
For open-sourced or publicly released models, security requires integrating safeguards before release. These measures include predeployment red-teaming, applying alignment measures, limiting potentially dangerous or high-risk capabilities, adding input validation, and providing clear integration guidance.
These controls apply after training and evaluation, when the system is being prepared for integration into applications or operational environments. At this stage, model weights and associated artifacts (architectures, parameters, learned representations, etc.) embody significant research investment and intellectual property, making them particularly valuable and vulnerable to unauthorized access or tampering.
Model weights are the primary element in the deployment phase, which includes trained parameters and artifacts that define model behavior. This includes model versions, integrity verification, and access restrictions.
Model Weights
Model Weights
| Subcategory | Identifier | Action or Control | Why the Control Is Relevant |
|---|---|---|---|
| Access control and authorization | MW.ACA-1 | Encrypt model weights and allow access only to authorized personnel | Encrypting model weights and restricting access to authorized personnel helps reduce the likelihood of unauthorized access, extraction, or replication of proprietary AI models. |
| MW.ACA-2 | Restrict access to model weights using role-based and privilege-based controls | Using role‑based and privilege‑based controls helps ensure that only authorized personnel with appropriate roles and privileges can access model weights, reducing the risk of unauthorized access, theft, or manipulation. | |
| Cryptographic protection of model weights | MW.CPMW-1 | Encrypt model weights at rest and in transit to ensure confidentiality and integrity | Encrypting model weights at rest and in transit helps protect confidentiality and integrity by reducing the likelihood of unauthorized access or extraction during storage and transmission. |
| MW.CPMW-2 | Use cryptographic techniques to protect model weights during generation and storage | Applying cryptographic techniques during generation and storage helps reduce the risk of unauthorized access or extraction of model weights. | |
| Infrastructure security management | MW.ISM-1 | Ensure secure configurations for systems generating and storing model weights | Maintaining secure configurations for systems that generate and store model weights helps reduce the likelihood of unauthorized access, theft, or exploitation. |
| Privacy-preserving techniques | MW.PPT-1 | Encrypt model weights and apply differential privacy techniques during model training | Encrypting model weights and applying differential privacy techniques helps protect against unauthorized access or extraction, support training data integrity, and reduce exposure to inference attacks. |
| Vulnerability management | MW.VM-2 | Regularly scan and patch systems, software, and network devices | Regularly scanning and patching systems, software, and network devices helps identify and mitigate vulnerabilities, reducing the risk of exploitation through misconfigurations or compromised components. |
To view the full list of security controls developed for each phase of the AI lifecycle, see Appendix B.