AID-H-007.001: Secure Training Environment Provisioning

Version 1.20261015 · Actionable sub-technique

This sub-technique focuses on the infrastructure layer of AI security. It covers the creation of dedicated, isolated, and hardened environments for training jobs using Infrastructure as Code (IaC), least-privilege IAM roles, and, where necessary, confidential computing. The goal is to build a secure foundation for the training process, protecting it from both internal and external threats, and ensuring the confidentiality and integrity of the data and model being processed.

Pillars: infra

Lifecycle: building, operation

Scope boundary

Owns creation of dedicated, isolated, least-privilege, and hardened training environments, including network, identity, compute, storage, IaC, and confidential-computing boundaries before a job starts.

AID-H-007.002: AID-H-007.001 provisions the trusted environment and permissions for a training job; AID-H-007.002 monitors the running job's behavior, stability, metrics, and audit trail. A hardened environment does not prove the job behaved correctly after launch.

Implementation guidance

AID-H-007.001-G001

Utilize dedicated, isolated, and hardened network environments for model training activities.
Concept:

A training environment has unique security requirements, such as broad access to sensitive datasets, that differ from production inference environments. Isolating it in a dedicated Virtual Private Cloud (VPC) prevents a compromise during an experimental training job from affecting live services, and vice-versa.

Step 1: Define a Dedicated VPC with Infrastructure as Code

Use a tool like Terraform to define a separate VPC for training workloads. This network should have no direct ingress from the internet and highly restricted egress rules to prevent data exfiltration.

# File: infrastructure/training_vpc.tf (Terraform)

resource "aws_vpc" "training_vpc" {
  cidr_block = "10.10.0.0/16"
  tags = { Name = "aidefend-training-vpc" }
}

resource "aws_subnet" "training_subnet" {
  vpc_id     = aws_vpc.training_vpc.id
  cidr_block = "10.10.1.0/24"
  map_public_ip_on_launch = false // Ensure no public IPs
}

resource "aws_network_acl" "training_nacl" {
  vpc_id = aws_vpc.training_vpc.id
  
  # Egress: Allow HTTPS client traffic; enforce destinations at private endpoints or an egress firewall
  egress {
    rule_number = 100
    protocol    = "tcp"
    action      = "allow"
    cidr_block  = "0.0.0.0/0"
    from_port   = 443
    to_port     = 443
  }
  # Network ACLs are stateless: allow return packets for client-side HTTPS.
  # Narrow the CIDR to the egress path or endpoint ranges used in your design.
  ingress {
    rule_number = 100
    protocol    = "tcp"
    action      = "allow"
    cidr_block  = "0.0.0.0/0"
    from_port   = 1024
    to_port     = 65535
  }

  # Deny unsolicited inbound traffic after the return-traffic exception.
  ingress {
    rule_number = 200
    protocol    = "-1"
    action      = "deny"
    cidr_block  = "0.0.0.0/0"
    from_port   = 0
    to_port     = 0
  }
}

Action: Provision a separate, dedicated cloud project or VPC for your training infrastructure. Network ACLs are stateless, so retain the ephemeral-port return rule for approved client connections. Use private service endpoints or a controlled egress proxy/firewall for destination allowlisting; a NACL alone cannot enforce repository DNS names.

Keep the action safely bounded

Admit only signed image/IaC and workload identity, mount authorized immutable inputs, deny host privilege and default egress, allow only signed destinations, isolate tenants/jobs, destroy ephemeral state on completion, and deny scheduling when effective controls cannot be read back.

Verify safely

A separately credentialed verifier independently reads back or replays each eligible training job and its isolated compute, image, dataset mounts, network/egress and ephemeral workspace, exercises positive, negative, boundary and dependency-failure fixtures, and reconciles the complete eligible population.

AID-H-007.001-G002

Apply the principle of least privilege for training jobs, granting only necessary access to data and resources.
Concept:

The identity that a training job runs as (e.g., a SageMaker execution role) should have the absolute minimum permissions required. If a training script is compromised, this prevents the attacker from using the job's role to move laterally or access unauthorized data.

Step 1: Craft a Minimal IAM Policy

Define an IAM policy that grants access only to the specific S3 prefixes for the input data and output artifacts. Deny all other access.

# File: infrastructure/training_role_policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ReadTrainingData",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::aidefend-datasets/image-data/v3/*"
        },
        {
            "Sid": "WriteModelArtifacts",
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::aidefend-model-artifacts/image-classifier/run-123/*"
        },
        {
            "Sid": "CloudWatchLogs",
            "Effect": "Allow",
            "Action": ["logs:CreateLogStream", "logs:PutLogEvents"],
            "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/TrainingJobs:*"
        }
    ]
}

Action: For each training job, create a dedicated, single-purpose IAM role. Attach a policy that only allows read access to the specific versioned dataset prefix and write access to the specific output prefix for that job run.

Verify safely

A separately credentialed verifier independently reads back or replays every human, service and workload identity plus role/session used by an eligible training job, exercises positive, negative, boundary and dependency-failure fixtures, and reconciles the complete eligible population.

AID-H-007.001-G003

Employ confidential computing (e.g., secure enclaves) for training on highly sensitive data.
Concept:

Use confidential computing for training jobs that process highly sensitive data or models.

Step 1: Provision confidential VM
gcloud compute instances create confidential-training-worker --zone=us-central1-f --machine-type=n2d-standard-8 --confidential-compute --shielded-secure-boot
Step 2: Verify node attestation state before starting training
gcloud compute instances describe confidential-training-worker --zone=us-central1-f --format="json(confidentialInstanceConfig,shieldedInstanceConfig)"

Action: Require attested confidential-compute state as a precondition in training-job admission policy.

Keep the action safely bounded

Verify fresh nonce/audience-bound attestation of the complete CPU/accelerator/firmware/runtime TCB before scoped key/data release, pin measurements and rollback policy, protect I/O, deny debug, and zeroize secrets/state on termination.

Verify safely

A separately credentialed verifier independently reads back or replays training jobs whose signed threat model requires TEE or confidential-accelerator protection, exercises positive, negative, boundary and dependency-failure fixtures, and reconciles the complete eligible population.

Open-source tools

Source-available / open-weight tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-H-007.001: Secure Training Environment Provisioning | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service