Academy module 4 · ISO/IEC 27090 · Lesson 4 of 8
Protect model artifacts and inference access
About 8 minutes · Introductory draft · Checked 2026-10-23
AI-authored and AI editorially reviewed; independent review pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Protect direct access and repeated-query exposure separately.
Explore the anchors
Restrict model stores signing and deployment identities.
Concept matching activity
Match this task or description to its concept:
Limit unnecessary outputs and observe abusive querying.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What you will learn
- Restrict model stores signing and deployment identities.
- Limit unnecessary outputs and observe abusive querying.
- Investigate suspicious patterns and update controls.
Concepts and distinctions
Model theft can involve direct access to artifacts or attempts to reproduce aspects of a model through its interface. Extracting a model’s behavior is not necessarily the same as recovering its exact parameters. Distinguish the asset being protected, the information exposed by responses and the permissions required to reach the artifact store.
Interface controls may include authentication, quotas, monitoring, restricted diagnostic outputs and contractual terms. These measures change attacker cost and visibility but do not prove extraction is impossible. A public endpoint can also support legitimate bulk use, so unusual query volume requires context. Protect model supply chains and deployment identities as well as the external API.
Apply the process and collect evidence
Map who can read, export, replace or deploy model artifacts. Log meaningful access and version changes without indiscriminately retaining sensitive prompts. Define use patterns that require review and coordinate product, security and privacy responsibilities. Investigate with preserved evidence before attributing intent or suspending a customer whose legitimate job may resemble automation.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A customer sends a high volume of carefully varied queries. Separately, an old service identity still has unrestricted model-store download permissions.
Compare your reasoning
Investigate the query pattern under the agreed policy while immediately assessing the unnecessary artifact permission through normal authority. Query monitoring does not repair excessive direct access. The two paths need distinct controls and evidence.
Remember
- Protect direct access and repeated-query exposure separately.
- Restrict model stores signing and deployment identities.
- Investigate suspicious patterns and update controls.
Orientation and further reading
- ISO: ISO/IEC 27090:2026 · Published AI-security guidance
- NIST AI 100-2 E2025: adversarial machine learning
Original examples and explanations. Background references do not establish complete exam coverage.
Try ISO/IEC 27090 practice questions · Report a content correction