Securing AI (e.g., Model Armor, Sensitive Data Protection, and secure model deployment)

Secure Infrastructure and Deployment Architectures

Google Cloud protects AI data at rest using default encryption, but organizations that need more control can use Customer-Managed Encryption Keys (CMEK) through Cloud Key Management Service. CMEK lets teams manage their own encryption keys, including rotation schedules and who can access them. This matters because AI models, training data, and temporary files created during processing all need protection from unauthorized access.

When deploying AI models, you must grant specific service agents the Cloud KMS CryptoKey Encrypter/Decrypter role so they can use your keys to encrypt and decrypt data. This follows the principle of least privilege, meaning you give only the minimum permissions needed. Audit logging tracks when and how keys are used, which helps teams spot suspicious activity.

To prevent data from being stolen or leaked, use VPC Service Controls to create a service perimeter around your AI projects. This acts like a digital fence that blocks unauthorized requests coming from outside the perimeter. A common unified perimeter works well for most organizations because it reduces complexity while still stopping data exfiltration.

For the most sensitive workloads, Confidential Space provides a Trusted Execution Environment that keeps data private even from Google operators. It uses a hardened operating system image so the AI workload cannot be tampered with or inspected while running. Services like Sensitive Data Protection work alongside these tools to detect and redact sensitive information before datasets are used for training.

Data Privacy and Sensitive Data Protection

Sensitive Data Protection identifies and manages personally identifiable information (PII) such as credit card numbers or addresses within Google Cloud. Before using data for AI training or inference, teams must classify what is sensitive so it gets handled correctly. Automated scanning finds sensitive information across large datasets, saving time and reducing human error.

De-identification removes or obscures sensitive identifiers to reduce risk while keeping data useful. Transformation templates apply these methods consistently across AI pipelines. Masking hides parts of a data string, tokenization replaces sensitive data with a non-sensitive token, and bucketing groups values into ranges to prevent specific identification.

VPC Service Controls create a service perimeter that prevents data from moving outside authorized areas, stopping exfiltration. The principle of least privilege ensures users and service accounts have only the permissions they need.

Data sovereignty and residency matter for global privacy compliance. Organizations use CMEK to manage their own security keys instead of relying on defaults, and resource location policies keep data in specific geographic regions to comply with laws like HIPAA.

Model Armor and Differential Privacy add extra security for generative AI. Differential Privacy adds noise to data, making it nearly impossible to identify specific individuals while still letting models learn patterns. Cloud Audit Logs provide a clear record of who accessed sensitive data and how it was used.

Mitigation of Model-Specific Vulnerabilities

Model Armor protects Large Language Models from prompt injections and jailbreaking attempts by screening user requests and model responses. It blocks harmful content before it reaches end users. This security layer integrates with Vertex AI and Google Kubernetes Engine, where it uses Service Extensions to monitor traffic flowing to and from inference gateways.

Secure model deployment also relies on Binary Authorization, which ensures only verified container images run in production. This prevents attackers from replacing legitimate AI components with malicious ones.

Administrators configure safety filters and content moderation thresholds to balance model usefulness with security requirements. Floor settings create global safety rules the model must follow, templates standardize security across different use cases, and sanitization cleans inputs and outputs to reduce risks like data disclosure.

Sensitive Data Protection identifies and masks PII within AI prompts using de-identification techniques. This prevents accidental disclosure of private data during training or inference and helps organizations stay compliant with privacy regulations.

Continuous monitoring through Cloud Logging and the AI Security Dashboard shows sanitization results and tracks security events in real time. IAM enforces least privilege so only authorized users can change model settings or access sensitive training data.