Implementation guide
OWASP AISVS v1.01
Model Lifecycle Management & Change Control · Pipeline Fine-Tuning
Verify each fine-tuning stage's output
Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.
OWASP AISVS v1.01, requirement 3.5.3
In plain English
In a fine-tuning pipeline with several stages, each stage builds on the files the last one produced. Check those files are intact before the next stage reads them, so a tampered or corrupted intermediate cannot carry through to the finished model.
What good looks like
- Each stage records a hash or signature of its output when it finishes.
- The next stage verifies that record before it starts.
- A failed check stops the pipeline and raises an alert.
- Intermediate outputs are stored where only the pipeline can write.
How teams usually do it
- Each step writes a manifest of output hashes, and the following step checks it. Pipeline tools such as Kubeflow Pipelines, MLflow and DVC record artifact hashes for you.
- Signed provenance per stage (in-toto attestations, the format SLSA uses) where you need to prove which step produced what.
- Content-addressed artifact storage, where a file's name is its hash.
Suggested evidence
- Pipeline definitions showing the checks.
- Logs from a recent run with each verification passing.
- Storage permissions on the intermediate artifacts.
Common mistakes
- Passing intermediate files through a shared folder with no checks.
- Verifying the final model only, which proves nothing about the stages before it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.