Implementation guide
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Secure Development Practices
Keep training apart from production
Verify that model training and fine-tuning environments are isolated from production environments.
OWASP AISVS v1.01, requirement 3.4.2
In plain English
Run training and fine-tuning away from production. Training environments pull in large amounts of data and third-party code, and people experiment there. A problem in training should have no route to live systems, and live data should not be exposed to experiments.
What good looks like
- Training runs in its own accounts or networks, with no direct route to production.
- Training jobs and the people running them hold no credentials that can write to production.
- A model reaches production only through the deployment pipeline, with its checks.
- Production data used for training is copied through a controlled process, and never read live.
How teams usually do it
- Separate cloud accounts or projects for training, with network rules that block traffic to production.
- A promotion step that copies approved, signed artifacts from the training registry to the production one.
- Short-lived credentials scoped to the training job.
Suggested evidence
- The network and account design.
- Promotion pipeline configuration.
- Access policies showing that training identities have no production write access.
Common mistakes
- Training jobs running with credentials that can also deploy.
- Notebooks in the training environment with standing read access to production databases.
- Hot-fixing a model by copying a file from a training machine straight to a production server.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.