18.1 Protecting AI Systems from Data & Model Exfiltration
Key Takeaways
- A VPC Service Controls perimeter around Agent Platform keeps training data, models, online inference requests, batch inference results, and Gemini models from leaving the perimeter.
- Adding Agent Platform to a VPC Service Controls perimeter blocks public internet access to it unless callers are explicitly allowed.
- Google recommends the restricted VIP with Private Service Connect for Google APIs or Private Google Access for private, perimeter-compatible access to Google APIs.
- Customer-managed encryption keys in Cloud KMS give control over key location, rotation, access, and cryptographic boundaries for Agent Platform resources.
- Least-privilege service accounts for training jobs, pipelines, notebooks, and deployed models limit what a compromised workload can read or copy.
Section 6.1 of the exam guide asks you to build secure AI systems by protecting against unintentional exploitation and leaks of data or models (for example, data exfiltration, malicious prompting, and sharing sensitive data with LLMs). This section covers infrastructure controls against exfiltration. Section 18.2 covers prompt-level defenses.
What Can Leak, and How
| Asset | Leak path examples |
|---|---|
| Training data | Copied to an external bucket, exported from a notebook, pulled by an over-privileged service account |
| Model artifacts (weights) | Downloaded from Cloud Storage or exported from Model Registry to another project |
| Online inference requests and responses | Logged to unprotected tables, sent over public paths |
| Batch inference results | Written to buckets outside the organization |
| Prompts and RAG context | Sensitive documents indexed into a chatbot anyone can query, or pasted into unapproved tools |
| The model's behavior | Model extraction through high-volume querying of a public endpoint |
Layer 1: Identity and Access (IAM)
- Least-privilege roles: give data scientists viewing and running permissions (for example, Agent Platform User,
roles/aiplatform.user) rather than Agent Platform Administrator (roles/aiplatform.admin), and restrict who can export models or change endpoints. - Custom service accounts for training jobs, pipelines, deployed models, Workbench instances, and Ray clusters, each with access to only the buckets, tables, and secrets it needs. Don't rely on broad default service accounts.
- Separate projects for development and production, so experimental notebooks can't read production data by default.
- No long-lived keys: use service account impersonation and workload identities instead of downloaded JSON keys.
- Secret Manager for API keys and credentials used by pipelines and serving containers.
Layer 2: VPC Service Controls Perimeters
VPC Service Controls (VPC-SC) creates a service perimeter that is independent of IAM. Even a user or service account with valid IAM permissions can't move protected data out of the perimeter.
When Agent Platform is protected, these artifacts can't leave the perimeter:
- Training data for AutoML or custom models
- Models you created
- Online inference requests
- Batch inference results
- Gemini models
Put BigQuery, Cloud Storage, Agent Platform, Artifact Registry, and Dataflow (and any other service the workflow uses) inside the same perimeter. Adding Agent Platform to a perimeter blocks public internet access to it, including console and programmatic calls, unless the caller is inside the perimeter or on an access level allowlist, such as corporate IP ranges.
Private access to Google APIs
| Option | Use |
|---|---|
| Private Service Connect for Google APIs (with the restricted VIP bundle) | Private API endpoints with a custom IP and DNS name, and on-premises access over hybrid networking |
| Private Google Access with the restricted VIP | Private route to Google APIs from VMs without external IPs |
Google's best practice is to use the restricted VIP so requests to protected services never cross the internet. Some producer services that use private services access (such as custom training data plane, Pipelines, private inference endpoints, and Vector Search queries) need extra network configuration inside VPC-SC.
Endpoint choices under VPC-SC (Chapter 14)
- Private Service Connect endpoints support VPC-SC. Dedicated public endpoints don't.
- Model Armor regional endpoints accessed from a VPC need a Private Service Connect endpoint to the Model Armor APIs to avoid certificate errors with Private Google Access or VPC-SC.
Layer 3: Encryption and Key Control
- Default encryption at rest covers Agent Platform content automatically.
- CMEK (Cloud KMS keys) gives control over key location, protection level, rotation, and access. Disabling a key blocks access to data encrypted with it. Supported across training, models, endpoints, pipelines, Workbench, Colab Enterprise, Feature Store Bigtable online stores, and more (check each feature).
- Confidential Computing (for example, Confidential VM for Workbench) protects data in use.
Layer 4: Organization Policies and Governance
- Custom organization policy constraints on Agent Platform resources (for example, training, inference, and pipelines) to restrict allowed configurations where supported.
- Model Garden organization policy to allow only vetted models.
- Data residency: restrict resource locations. Avoid the Gemini global endpoint when processing location matters (Chapter 4).
- Access Transparency logs show Google staff actions on your content where supported.
Layer 5: Detection and Auditing
- Cloud Audit Logs for administrative actions (model export, endpoint changes, IAM changes) and data access where enabled.
- Alerts on unusual exports, new external buckets, or sudden spikes in prediction volume, which may signal model extraction.
- Rate limits and quotas on public-facing inference to slow scraping.
Gen AI-Specific Leak Paths
| Risk | Control |
|---|---|
| Employees pasting confidential data into consumer AI tools | Provide an approved enterprise gen AI application with data governance, plus policy and training |
| RAG chatbot exposing documents users shouldn't see | Enforce document-level access control in retrieval, and don't index what the audience can't access |
| Sensitive data in prompts or responses | Model Armor Sensitive Data Protection filters, and redaction before sending (Section 18.2) |
| Prompt and response logs holding PII | Restrict and expire log tables, or log de-identified content |
| Tuning data containing secrets | Scan with Sensitive Data Protection before tuning (Chapter 5) |
Worked Scenario
A pharmaceutical company trains models on clinical trial data and serves predictions to internal apps. Requirements: no data or models may leave the company's control, even if credentials are stolen.
- Put BigQuery, Cloud Storage, Agent Platform, Artifact Registry, and Dataflow inside one VPC-SC perimeter, with access levels for corporate networks only.
- Use Private Service Connect for Google APIs with the restricted VIP from on-premises.
- Serve models from Private Service Connect endpoints.
- Run training, pipelines, and notebooks as dedicated least-privilege service accounts, and apply CMEK with keys in the required region.
- Enable audit logs and alerts for model export and IAM changes.
A security team worries that a data scientist with valid IAM permissions could copy training data and trained models to a personal project. Which control specifically prevents protected data from leaving an approved boundary even with valid credentials?
After adding Agent Platform to a VPC Service Controls perimeter, analysts working from corporate offices outside the perimeter can no longer reach Agent Platform APIs. What is the correct fix?
Which practice best limits the damage if a custom training job's container is compromised?