Disrupting the Model

The talk opens with the case that organizations are adopting machine learning platforms quickly, while the environments that train, tune, deploy and maintain models get little offensive or defensive attention. The presenters, from IBM X-Force Red, argue that the wider MLOps ecosystem, including data stores, orchestration, APIs and connected identity systems, is a valuable target that red teams should model. They note that commercial platforms often ship with audit logging and detections turned off, which leaves responders unprepared.

The middle section introduces a toolkit released alongside a white paper, which simulates REST API abuse against three commercial platforms using stolen access tokens or API keys. Live demos cover reconnaissance and model theft on Azure ML after a device code phishing scenario, and on Google Vertex AI after lateral movement to an engineer's workstation. Big ML was discussed but not demonstrated, and its cloud offering offers no logging to examine.

The closing advice focuses on threat modeling ML infrastructure, enabling audit logs, enforcing MFA, rotating credentials and applying least privilege. Defenders should watch for command and control beaconing from training environments and unusual lateral movement between platforms. The speakers also flag supply chain risk from untrusted model downloads, and point to detection content in the white paper such as queries, YARA and Sentinel rules.