# Security and privacy for ML systems

A pack of 8 sessions from the MLOps Community YouTube channel, in the order to watch them. 5h 18m of video.
Page: https://mlopstalks.com/packs/security-and-privacy-for-ml-systems

A downloaded model brings executable code into your environment. A prediction service reveals information about its training data. A request to remove one person's records reaches a data lake designed never to change. These are different problems, so begin by separating security from privacy and identifying what needs protection. Follow the threats through external artifacts, deployment systems and the data itself. The middle talks compare privacy methods, then examine the limits of noisy statistics and encrypted computation in more detail. Finish with an application that connects a language model to private data and tools, where permissions determine how far an injected instruction can reach. The talks span 2020 to 2024; use their mechanisms and failure cases without treating historical tools or legal commentary as current guidance.

## This pack is for you if

- Your models, datasets or dependencies come from outside sources you have not assessed.
- You need to use sensitive data while limiting what individuals or other parties can learn.
- Your model can access private records or tools, and you have not mapped the resulting attack paths.

## The talks, in order

### 1. Security and Privacy

Ads Dawson, Kaseya & Katharine Jarmul, Thoughtworks & David Haber, Lira | 34:37 | AI in Production 2024
Video: https://www.youtube.com/watch?v=FvHPnuwH6rg
Summary: https://mlopstalks.com/talks/security-and-privacy.md

Why first: The panel separates protecting a system from protecting the people whose information it processes. Prompt monitoring itself can create privacy exposure. Establish that distinction before choosing controls, then use the following threat examples to decide which data flows and model behaviors need attention.

### 2. ML Security: Why should you care?

Sahbi Chaieb, SAS | 52:20 | MLOps Coffee Sessions
Video: https://www.youtube.com/watch?v=wohiPdSt2as
Summary: https://mlopstalks.com/talks/ml-security-why-should-you-care.md

Why second: Chaieb follows risks into training data, pretrained artifacts, prediction APIs and distributed updates. The model inherits ordinary software threats and adds ways to leak or manipulate learned behavior. This widens the inspection beyond the public endpoint before the next talk turns it into repeatable operating work.

### 3. MLSecOps is Fundamental to Robust AI Security Posture Management

Sean Morgan, Protect AI | 42:36 | MLOps Podcast
Video: https://www.youtube.com/watch?v=hUsuSst_K_M
Summary: https://mlopstalks.com/talks/mlsecops-is-fundamental-to-robust-ai-security-posture-management.md

Why here: Morgan makes artifact origin, lineage and automated scans part of development and deployment. Recording which datasets produced which models helps a team respond when a source is later found unsafe. Those controls address what enters the system; the next account asks whether the system can remove personal data once it is there.

### 4. The intersection between DataOps and privacy

Lars Albertsson, Scling | 33:26 | MLOps Community podcast series
Video: https://www.youtube.com/watch?v=bEvTXcEr3pQ
Summary: https://mlopstalks.com/talks/the-intersection-between-dataops-and-privacy.md

Why here: Albertsson describes the engineering conflict between immutable shared data and deleting an individual's records. Separating personal data or planning for reprocessing changes the design before collection. This grounds the privacy discussion in storage and change management, rather than assuming a mathematical technique can repair an unsuitable data architecture.

### 5. Are Privacy-Enhancing Technologies a Myth?

Fabiana Clement, MLOps Community & Charles Radcliffe | 22:59 | MLOps Community
Video: https://www.youtube.com/watch?v=HOSbcySk6yI
Summary: https://mlopstalks.com/talks/are-privacy-enhancing-technologies-a-myth.md

Why here: This overview distinguishes encrypted computation, differential privacy, federated learning and synthetic data. Their limitations differ: keeping data local adds coordination work, and generated data inherits weaknesses in its source. Use the comparison to identify a candidate mechanism, then examine the next two talks and their narrower guarantees.

### 6. Privacy-preserving ML with Differential Privacy

Christos Dimitrakakis, University of Oslo & Fabiana Clemente | 35:56 | MLOps Community
Video: https://www.youtube.com/watch?v=0XlGbjNDO9M
Summary: https://mlopstalks.com/talks/privacy-preserving-ml-with-differential-privacy.md

Why here: Dimitrakakis explains how useful aggregate learning can coexist with uncertainty about individuals, then shows where the promise ends. Privacy loss accumulates across releases, and protecting one defined record does not hide every correlated fact. This is the detail needed before translating a privacy parameter into a claim about the system.

### 7. ML and Encryption: It's All About Secure Insights

Fabiana Clemente, MLOps Community & Théo Ryffel, Arkhn and Open-Mined | 36:06 | MLOps Community
Video: https://www.youtube.com/watch?v=CNurhz_AALg
Summary: https://mlopstalks.com/talks/ml-and-encryption-its-all-about-secure-insights.md

Why here: Ryffel asks a different question: who may see the data, the model or the agreed result during computation? Secret sharing makes the mechanism tangible, while the distinction between curious and malicious participants exposes an important assumption. A convenient encryption call does not choose that threat model for you.

### 8. Guarding LLM and NLP APIs: A Trailblazing Odyssey for Enhanced Security

Ads Dawson, Cohere | 59:41 | MLOps Podcast
Video: https://www.youtube.com/watch?v=u-VCfL3l_lw
Summary: https://mlopstalks.com/talks/guarding-llm-and-nlp-apis-a-trailblazing-odyssey-for-enhanced-security.md

Why last: Dawson returns to the complete application, where retrieved instructions can reach tools and private records through excessive permissions. His threat-modeling examples connect inputs, outputs and access tokens. End by checking those concrete paths and limiting authority, rather than assuming model-level defenses protect everything attached to it.