This section covers using Google Cloud tools to find, mask, and stop sensitive data from accidentally leaking into or out of AI models during training and use.
Cloud Sensitive Data Protection is a managed service that finds and hides sensitive information in data. It scans text and files using over 100 built-in detectors for things like credit card numbers or names, and it can also use custom patterns. In a typical workflow, raw data flows from Cloud Storage into a Cloud Dataflow pipeline. This pipeline uses Sensitive Data Protection to transform the data, applying methods like redaction (hiding parts of the data) or tokenization (replacing data with a safe token), before writing the safe data into BigQuery. For tokenization, keys are managed by Cloud Key Management Service (Cloud KMS) or Cloud Hardware Security Module (Cloud HSM) to keep them secure.
Model Armor is a security service that checks and cleans the prompts sent to AI models and the responses they generate. It sits between the user and the model. When a user sends a prompt, Model Armor checks it first for risks like sensitive data or malicious instructions before letting it pass to the model. After the model creates a response, Model Armor checks that response again before sending it back to the user. Administrators set up rules and thresholds in Model Armor to define what is considered a risk, and they can set a baseline level of protection for all projects using Gemini models.
BigQuery has built-in controls to protect data when it is stored and when users query it. Administrators can tag sensitive table columns with policy tags like 1_Sensitive. When a user runs a query, BigQuery checks if they have the special Fine-Grained Reader role; if they do, they see the real data, but if they don't, they see a masked version. For stronger protection, column-level encryption can be used with keys from Cloud HSM. BigQuery also supports differential privacy, which adds mathematical noise to query results. This hides individual records while keeping overall statistics accurate, which is useful for training models without exposing personal data.
VPC Service Controls (VPC-SC) creates a network security wall around Google-managed services like Vertex AI, BigQuery, and Cloud Storage. This wall, called a perimeter, blocks data from being copied or sent to unauthorized places outside the wall. Access across this wall is strictly controlled by Identity and Access Management (IAM) policies and rules about where the request is coming from, like specific IP addresses. All access events are logged to Cloud Logging for auditing, helping to ensure that any attempt to move data out of the secure area can be detected and investigated.
This section explains how to protect AI systems from attacks where malicious users try to trick the model into doing harmful things or leaking data.
Prompt injection attacks trick AI models into ignoring their original safe instructions. Jailbreaks are methods to bypass a model's built-in safety filters. These attacks can lead to data leaks, unauthorized access, or the generation of harmful content. The risk is high in applications where AI models directly process untrusted user input, especially if the models have access to sensitive data.
Vertex AI includes configurable safety filters that check model outputs for harmful content like hate speech or harassment. These filters work independently from the model itself, making them harder for attackers to bypass. Administrators set blocking thresholds (like BLOCK_MEDIUM_AND_ABOVE) to determine what level of harmful content gets blocked. They are enabled in the API by setting the safe_search parameter and apply to both search results and generated text.
System instructions (or preambles) are directions given to the AI model at the start of a conversation to set its behavior, like telling it not to answer questions about politics. These instructions guide the model directly but are not foolproof; models can sometimes ignore them or be tricked by clever attacks. Therefore, system instructions should be used together with external safety filters for a stronger, layered defense.
Model Armor is a Google Cloud service that provides advanced security screening for AI applications. It uses configurable filters to detect prompt injections, jailbreaks, sensitive data, and malware in both user prompts and model responses. Administrators set up templates to define what risks to look for and the minimum thresholds for action. Project-level "floor settings" can be configured to ensure a default level of protection is always applied to Gemini models.
The Cloud Sensitive Data Protection (DLP) API can be used to scan and clean text before it is sent to an AI model. It identifies sensitive information like PII or financial data and can redact, mask, or tokenize it. This prevents sensitive data from ever reaching the model in the first place. The same API can also scan the model's output before it is returned to the user, ensuring no sensitive data is accidentally generated.
Another defense strategy is to use a smaller, faster AI model like Gemini Flash as a filter. In this approach, the user's prompt or the main model's response is sent to this filter model, which is instructed to judge if the content is safe based on specific policies. This method is highly customizable and can analyze different types of media, but it adds extra cost and latency to the overall process.
Continuous monitoring is key for detecting attacks. Enabling Cloud Audit Logs for AI services creates a record of all API calls and access events. These logs show who did what, when, and from where. Monitoring these logs helps spot suspicious activity, like unusual data access patterns or configuration changes that could indicate a security threat. This audit trail is also essential for compliance investigations.
To prevent data from being stolen, VPC Service Controls should be set up to create a security perimeter around all AI-related services. This network-level control blocks unauthorized data transfers outside the defined boundary. When combined with strict IAM permissions (the principle of least privilege), VPC-SC ensures that sensitive data and model artifacts remain within a controlled environment and cannot be exfiltrated to unauthorized locations.
This section details how to use network boundaries, strict access controls, encryption, and logging to stop the unauthorized transfer of data and AI models.
VPC Service Controls (VPC-SC) is the main Google Cloud service for preventing data exfiltration. It works by creating a security perimeter, or boundary, around a group of managed services like Vertex AI, Cloud Storage, and BigQuery. Data and resources inside this perimeter can interact, but any attempt to copy data to a destination outside the perimeter is blocked. This control adds a network-layer defense on top of IAM, stopping exfiltration even if a user's credentials are compromised.
Using fine-grained Identity and Access Management (IAM) roles is crucial for model governance. This means giving users and service accounts only the exact permissions they need—no more. For example, a service account running a training job should only have permission to read its specific input dataset and write to its output model registry, not to delete entire storage buckets or change IAM policies. Regularly reviewing permissions and avoiding the use of overly powerful default accounts enforces the principle of least privilege and reduces the attack surface.
Customer-Managed Encryption Keys (CMEK) give you control over the encryption keys used to protect your AI data at rest. Instead of using Google's default keys, you create and manage your own keys in Cloud Key Management Service (Cloud KMS). You then authorize services like Vertex AI to use these keys to encrypt resources such as models, datasets, and notebooks. This means your data cannot be decrypted without your specific key. It's important to note that CMEK must be enabled when a resource is first created; you cannot apply it to an existing Vertex AI Workbench instance or Persistent Disk.
Cloud Audit Logs provide a complete, unchangeable record of administrative actions and data access within your Google Cloud project. You enable these logs for services like Vertex AI and BigQuery. The logs record the identity of the actor, the action taken, the time, and the source of the request. By analyzing these logs—for example, by sending them to Cloud Logging or a Security Information and Event Management (SIEM) system—you can detect suspicious behavior, such as a sudden spike in data read operations, which might signal an attempt to exfiltrate information.
Cloud Sensitive Data Protection is designed to find and mask sensitive data within datasets and text streams, often used in data preprocessing. Model Armor is focused on securing the interaction with generative AI models, screening prompts and responses in real-time for security threats like prompt injection and jailbreaks, not just sensitive data.
Use VPC Service Controls when you need to add a network-layer defense to prevent data exfiltration. IAM controls who can access resources based on identity, but VPC-SC controls where data can go based on network boundaries, blocking transfers even if an account's credentials are compromised.
No, you cannot apply CMEK to an existing Vertex AI Workbench instance or Persistent Disk. Customer-Managed Encryption Keys must be enabled at the time the resource is initially created. To use CMEK, you would need to create a new instance with CMEK enabled.
Using a separate, fast model as a filter provides highly customizable and robust content safety checking. It can be tailored to specific brand and safety policies and can analyze multiple media types. The trade-off of added cost and latency is often acceptable for critical applications where preventing harmful outputs or data leaks is a top priority.
Professional Machine Learning Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts