Frankenpipe: Bringing Secure ML Pipelines To Life by Patrick Smyth 🔗 **Source:** [Frankenpipe: Bringing Secure ML Pipelines To Life by Patrick Smyth](https://www.youtube.com/watch?v=jefbTBfl9Ps) > [!note]+ Document Notes > tags: [ml-ops, mlops-security, ml-pipeline, secure-containers] > author: Patrick Smyth > source: YouTube > reference: https://www.youtube.com/watch?v=jefbTBfl9Ps > date created: 2025-01-08 14:30 > > # 🏷️ Title: Frankenpipe: Bringing Secure ML Pipelines To Life > <!-- deep-read:sections start --> ## 🧰 Action Inbox - [H1] Implement safe tensors format instead of pickle files — avoid arbitrary code execution #ml-security - [H2] Set up container vulnerability scanning with Grype — identify CVEs before deployment #container-security - [H3] Add artifact signing to ML pipeline stages — prevent supply chain attacks #supply-chain ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Frankenpipe Repository](https://bit.ly/frankenpipe) - [Chainguard Docker Images](https://cgr.dev/chainguard/pytorch) ## 📝 Summary - Patrick Smyth demonstrates building a secure ML pipeline called "Frankenpipe" that emphasizes security over performance optimization - The pipeline implements vulnerability scanning, artifact signing, safe model serialization, and secure container infrastructure - Key security challenges include pickle file vulnerabilities, container CVEs, data poisoning attacks, and supply chain compromises - The demo shows a spooky/non-spooky image classifier with 17 pipeline steps including data synthesis, container scanning, and model signing - Bottom line: MLOps tooling in 2025 lacks mature security defaults, requiring practitioners to actively implement security measures ## 📖 Main Content The presentation addresses the current state of MLOps security, arguing that while the ecosystem appears mature on the surface, it suffers from significant security vulnerabilities that require active mitigation. Smyth demonstrates a complete ML pipeline that prioritizes security considerations over traditional performance metrics. The "Frankenpipe" serves as an educational tool showing how to implement security best practices across data pipelines, training pipelines, and inference pipelines. Key technologies include PyTorch for consistency across training and inference, Prefect for workflow orchestration, safe tensors for model serialization, Grype for vulnerability scanning, and Chainguard images for secure container infrastructure. The demo reveals practical challenges in implementing secure MLOps practices, including the complexity of managing secrets, the time cost of vulnerability scanning, and the need for artifact signing throughout the pipeline lifecycle. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=0) — [H1] Introduction and Speaker Background - Key idea: Patrick Smyth introduces Frankenpipe as a security-focused ML pipeline demonstration - Evidence: "Principal developer relations engineer at Chain Guard... open source nerd" #### ⏱️ [02:30](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=150) — [H2] MLOps Reality vs Marketing - Key idea: MLOps appears mature in marketing materials but has significant practical challenges - Evidence: "MIT basically said 95% of AI projects fail... brittle workflows and data wasn't being fed back" #### ⏱️ [04:45](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=285) — [H3] MLOps as Franken-Discipline - Key idea: MLOps requires expertise across multiple distinct technical domains - Evidence: "Software engineering, DevOps CI/CD, data engineering, ML fundamentals, MLOps specific tools" #### ⏱️ [06:15](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=375) — [H2] Three-Stage Pipeline Architecture - Key idea: ML pipelines consist of data, training, and inference sub-pipelines requiring multiple teams - Evidence: "Each of these subpipelines would be run by two or three teams of developers" #### ⏱️ [08:30](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=510) — [H1] Technology Stack Choices - Key idea: Tool selection prioritizes security over performance optimization - Evidence: "PyTorch... Prefect... safe tensors... gripe for scanning and chain guard images" #### ⏱️ [11:00](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=660) — [H2] MLOps Tooling Maturity Problem - Key idea: 2025 MLOps ecosystem lacks mature security defaults requiring active practitioner vigilance - Evidence: "If the ecosystem is not mature... it's really much more on us... to be critical" #### ⏱️ [14:15](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=855) — [H1] Live Demo Setup - Key idea: Pipeline demonstration includes 17 steps with security-focused workflows - Evidence: "17 steps... very simple ML pipeline... hundreds of steps... more concerned with security" #### ⏱️ [18:45](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=1125) — [H2] Data Provenance and Security - Key idea: Data sourcing presents immediate security challenges requiring careful selection strategies - Evidence: "Four practical answers... curated data set... business intelligence... user-generated content... synthesized data" #### ⏱️ [22:30](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=1350) — [H1] Data Poisoning Attack Vectors - Key idea: Simple attacks like single poisoned images can compromise entire models - Evidence: "Purple square in an image... as little as one image... will trigger data poisoning attack" #### ⏱️ [25:00](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=1500) — [H1] Pickle File Vulnerability Problem - Key idea: Standard pickle serialization format allows arbitrary code execution during deserialization - Evidence: "Bunch of op codes... when they get deserialized... arbitrary code can be run" #### ⏱️ [27:15](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=1635) — [H2] Safe Tensor Alternatives - Key idea: Safe tensors and other formats prevent code execution during model loading - Evidence: "Safe tensors... created by hugging face... can't run arbitrary code" #### ⏱️ [30:45](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=1845) — [H1] Container Vulnerability Landscape - Key idea: Standard AI containers contain hundreds of known vulnerabilities requiring remediation - Evidence: "PyTorch image... going to have hundreds of known vulnerabilities CVEs" #### ⏱️ [33:30](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=2010) — [H2] Chainguard Security Solution - Key idea: Purpose-built secure containers eliminate CVEs through ground-up OS design - Evidence: "Chainguard OS... designed from the ground up to be secure... very few or no CVEs" #### ⏱️ [36:00](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=2160) — [H1] Artifact Signing Importance - Key idea: Supply chain attacks target build and distribution systems requiring signature verification - Evidence: "Ultralytics attack in December 2024... compromise different parts of build or distribution system" #### ⏱️ [39:15](https://www.youtube.com/watch?v=jefbTBfl9Ps&t=2355) — [H2] Pipeline Results and Reports - Key idea: Comprehensive reporting enables observability across security scanning and signing processes - Evidence: "Generating reports is cheap... scanning is relatively cheap... signing is super cheap" ## 📚 References - [Frankenpipe GitHub Repository](https://bit.ly/frankenpipe) - [Chainguard PyTorch Images](https://cgr.dev/chainguard/pytorch) - [Prefect Workflow Orchestration](https://prefect.io) - [Safe Tensors Format](https://huggingface.co/docs/safetensors) - [Grype Vulnerability Scanner](https://github.com/anchore/grype) - [Cosign Signing Tool](https://sigstore.dev) ## 🗣️ Paraphrase - MLOps in 2025 appears sophisticated in marketing materials but suffers from immature security tooling that requires practitioners to actively implement protections rather than relying on secure defaults - The Frankenpipe demonstrates a complete secure ML pipeline emphasizing vulnerability scanning, artifact signing, safe serialization formats, and secure container infrastructure over traditional performance optimization - Key security threats include pickle file code execution vulnerabilities, container CVEs, data poisoning attacks, and supply chain compromises that can be mitigated through careful tool selection and security practices ## 📰 Newsletter 🔒 **Securing Your ML Pipeline: Lessons from Frankenpipe** This week we're exploring ML security with Patrick Smyth's "Frankenpipe" demonstration, showing how to build secure machine learning pipelines in 2025. While MLOps tooling has matured rapidly, security practices haven't kept pace, leaving practitioners vulnerable to supply chain attacks, data poisoning, and container vulnerabilities. **Key Security Practices:** - Replace pickle files with safe tensors to prevent code execution during model loading - Implement container vulnerability scanning with tools like Grype - Sign all artifacts throughout your pipeline to prevent supply chain attacks - Use secure base images like Chainguard's hardened containers **Practical Application:** Start by auditing your current ML pipeline for pickle file usage and container vulnerabilities. Even simple changes like switching serialization formats can dramatically improve your security posture. The demo repository provides hands-on examples you can adapt for production workflows, emphasizing that security doesn't have to compromise functionality. Resources: [Frankenpipe Demo](https://bit.ly/frankenpipe), [Chainguard Images](https://cgr.dev/chainguard/pytorch), [Safe Tensors Guide](https://huggingface.co/docs/safetensors) ## ✅ Action Items #### DevRel - Developer advocacy: Create security-focused ML pipeline workshops and conference talks demonstrating practical vulnerability mitigation - Education: Develop curriculum covering secure MLOps practices, container hardening, and artifact signing workflows - Developer experience: Improve documentation for safe tensors adoption and vulnerability scanning integration - Developer marketing: Campaign highlighting security gaps in standard MLOps tooling and solution approaches - Community management: Moderate discussions around ML security best practices and tool recommendations #### OSPO - Policy & Governance: Establish ML pipeline security policies requiring vulnerability scanning and artifact signing - License Compliance: Review safe tensors and security tooling licenses for enterprise compatibility - Security Management: Integrate ML-specific vulnerability scanning into existing security workflows - Software Inventory: Track ML frameworks, container images, and serialization formats in SBOM strategy - Developer Support: Provide training on secure MLOps practices and tooling selection - Community Engagement: Fund development of open source ML security tooling and standards #### Community - Maintainers: Support MLOps projects in implementing security defaults and vulnerability disclosure processes - Contributors: Create onboarding paths for security-focused ML tooling contributions - Sponsors: Fund development of secure ML infrastructure and educational resources - Ecosystem: Coordinate security standards across ML frameworks and deployment platforms #### WordPress - Core AI: Implement guardrails for ML model integration including vulnerability scanning and safe serialization - Core Performance: Profile ML workload security overhead and optimize secure implementations - Security: Develop ML-specific security scanning for plugins using AI/ML capabilities - Documentation: Create guides for secure AI/ML integration in WordPress environments ## 🧪 Hypotheses - Organizations using pickle files for model serialization face significantly higher risk of code execution attacks compared to those using safe tensors or similar formats - MLOps pipelines implementing artifact signing and vulnerability scanning experience fewer successful supply chain attacks than those relying on default tooling - Container images built from security-focused base images like Chainguard require less ongoing vulnerability remediation compared to standard upstream images - Teams implementing comprehensive ML pipeline security practices achieve better compliance outcomes and reduced incident response costs ### 📊 Methodology - Study design: Comparative analysis of ML pipelines with and without security controls measuring attack success rates and vulnerability exposure - Data sources: CVE databases, container image scanning results, incident response metrics from organizations with varying security maturity - Experiments: Deploy identical ML workloads using different serialization formats, base images, and security practices while measuring attack surface and performance impact ### ❓ Questions - How can MLOps platforms implement secure defaults without compromising developer experience or deployment velocity? - What metrics best indicate ML pipeline security maturity and how should organizations prioritize security investments? - How do emerging AI/ML attack vectors like adversarial inputs interact with traditional infrastructure security concerns? ### 🔮 Future Research - Development of automated ML security testing frameworks that integrate with existing CI/CD pipelines - Investigation of security implications for federated learning and distributed ML training architectures - Analysis of privacy-preserving ML techniques and their interaction with traditional security controls ### 💡 Implications - Practice: ML practitioners must actively implement security measures rather than relying on framework defaults - Policy: Organizations need ML-specific security policies covering data provenance, model serialization, and artifact signing - Security: Traditional application security practices require adaptation for ML-specific attack vectors and vulnerabilities - Education: ML engineering curricula must integrate security practices alongside traditional performance optimization - Funding: Investment in secure MLOps tooling and infrastructure becomes critical for production AI deployments ### 🧠 Learning Styles Assessment Reading level estimate: 12-14 (Graduate level technical content) #### 👀 Visual learners - Present: Pipeline diagrams, container architecture visuals, security flow charts - Improve: Add vulnerability scanning result visualizations, attack vector diagrams, security maturity models #### 🔊 Aural learners - Present: Live demonstration with verbal explanation of each security step - Improve: Audio-only version explaining security concepts without visual dependencies #### 🗣️ Verbal learners - Present: Clear definitions of CVEs, pickle vulnerabilities, supply chain attacks - Improve: Security concept analogies, real-world attack story examples #### 🧩 Kinesthetic learners - Present: Hands-on GitHub repository with runnable security pipeline examples - Improve: Interactive security scanning exercises, step-by-step vulnerability remediation labs #### 🧠 Logical learners - Present: 17-step pipeline breakdown, systematic vulnerability categorization - Improve: Security decision trees, risk assessment frameworks, cost-benefit analysis #### 🧑‍🤝‍🧑 Social learners - Present: Live Q&A session, community discussion of security practices - Improve: Peer review of security implementations, collaborative threat modeling exercises #### 🧘‍♀️ Solitary learners - Present: Self-contained repository for independent exploration - Improve: Security assessment checklists, self-paced vulnerability analysis worksheets #### 🌿 Naturalistic learners - Present: Ecosystem view of MLOps security interdependencies - Improve: Security lifecycle thinking, threat landscape evolution patterns ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive slide transitions - Improve: Alt text for security diagrams, detailed descriptions of visual pipeline flows #### Keyboard navigation - Present: Standard presentation navigation - Improve: Keyboard shortcuts for demo sections, accessible code examples #### Contrast and readability - Present: High contrast slides with clear typography - Improve: Ensure code examples meet contrast requirements, larger font sizes for technical details #### Text resizing and reflow - Present: Scalable presentation format - Improve: Responsive code examples, reflowing technical diagrams #### Media an <!-- deep-read:sections end --> ## 📺 Video  --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=jefbTBfl9Ps)* **[00:05]** So, welcome to Frank and Pipe. Uh, so this is this talk is Frank and Pipe bringing secure ML pipelines to life. And I'm Patrick Smith. I work at Chain Guard. Uh, I'm a principal developer relations engineer. I'm kind of an open source nerd. I I do some self-hosting on the weekends, run a music server, that kind of thing. I love Emacs. I use Linux as a daily driver. So, it's been great to have all these conversations. Um, you know, I like upgraded my lanyard to nextcloud here or whatever. So, uh it's **[00:37]** it's been great having all these conversations and and it's a great energetic conference. Um, when I'm not uh hanging out with my kids in Queens, uh, or my my wife and my kid, I I like I'm one of these annoying people who likes to like sit in the sauna, sit in the cold pool, you know? Uh but um but we're going to have a little bit of a I hope this one will be kind of fun as well as uh maybe maybe uh uh get some actual information out there about ML pipelines in 2025. So what are **[01:07]** we going to be doing and what does Frankenpipe mean? Uh so uh we are going to be talking about the state of ML ops in 2025 uh and making ML pipelines. We are going to be uh talking about like well why would you uh make a Franken pipe or why would you do this little experiment that we're doing. Uh we're going to talk about some technology choices and we're going to then bring the Franken pipe to life. We'll do a live demo. Hopefully my laptop doesn't explode dramatically, but if it does, I'm sure it'll make good tape. And uh **[01:39]** and then we'll we'll wrap up by talking a little bit about the state of ML ops and pipeline maturity in 2025 and how things some of the ecosystem could be improved and failing that how some of you guys can work around and be secure even if it it doesn't. That's uh Leslie Nielsen from uh Dracula Dead and Loving It, which is a very silly movie. All right. So if you Google ML Ops, it seems very rosy if you're looking around. Uh it's like oh digital transformation. Uh **[02:09]** oh let me tell you about all the stages of the the pipeline. It's like oh here's a definition of this here's a definition of that. It's really makes it sound like it's kind of a pretty mature put together ecosystem. Um is it uh I would say right now the state of MLOps is a little uglier than that. Okay. And there's more pain than than you would think. And uh so I was uh you know uh people were talking in August and September about this report that came out. MIT basically said 95% of um AI **[02:40]** projects fail. That includes um infrastructure projects, vendor projects and um and some of the reasons there were brittle workflows and also that data wasn't being fed back into the beginning of the pipeline. Um so so really there is a lot of pain out there. A lot of organizations are struggling with their pipelines and it's hard to be boots on the ground in MLOps right now for a lot of different reasons. We're going to go into some of that pain right now. So, one I was looking around and I I saw uh an article on oh how what do **[03:11]** you need to know if you're going to do MLOps? Another very enthusiastic article and it was like basically a laundry list of everything you could possibly imagine. So you need to know um software engineering, you need to know uh DevOps uh CI/CD, you need to know data engineering which is a whole other discipline. You need to know ML fundamentals which is like math and stuff. You need to know ML uh MLOps specific tools. I actually added security and compliance to this. Oh, did we go ahead? I actually added uh and run rushed ahead **[03:41]** for some reason. uh security compli compliance to this list, but it's basically an endless list of things. Um, and you know, the question is, is MLOps kind of a little bit of a Franken discipline? Um, and the answer is, uh, you know, yes. Uh, someone was, uh, I I was looking at Reddit when I was preparing for this talk and and there was a post like, oh, how did you get into MLOps? And some snarky person was like, oh, I got into MLOps by uh by going into my email uh and changing my signature from DevOps to **[04:11]** MLOps. um which I thought was kind of funny, but but really it is right now it's kind of like a discipline that's grown out of of DevOps and and it's it's kind of been set we've been set back a little bit. Okay, we're going to go into a little bit of what what I mean by that. So here's another kind of little bit of pain that people might be feeling in MLOps and this is where we'll get into the Franken pipe. Okay. Um so, uh here there's three, you know, and there's different ways to split things up, but there's one way of looking at it, which is three broad stages to the uh to **[04:43]** creating an ML pipeline or three sub pipelines. That's your your data pipeline, your training pipeline, and your inference pipeline. And I got this um uh this from this blog, they were like, oh, uh you know, in a in a large organization, each of these subpipelines would be run by two or three teams of of developers, you know, DevOp folks, whatever. And uh that's a lot. Okay. And and there's kind of an issue with that, which is, you know, this is it's a little hard as one technologist, as one contributor to uh get get a real feel **[05:15]** for what matters in the pipeline. And if if you're kind of atomized that way, it's a little hard to, you know, to see the forest for the trees. Um so let's kind of pretend this ecosystem isn't as complicated as it is. Um and see what we can learn um by building a Franken pipe. And uh then this is a mad scientist. I guess he's resuscitating a chicken. Uh I don't know if you can actually see the chicken back there. But um but yeah, we're going to build a Franken pipe. Um we're going to uh or it's already been built basically, but we're going to run it uh later. But we're going to talk **[05:45]** about some of the go going through an ML pipeline end to end and thinking specifically about certain aspects of it. Okay. And so things we're not going to be talking about because honestly this is what people do do love to talk about and it is important but it gets enough attention. uh talking about um hyperparameters talking about um you know oh what plat what cloud platform I ran on okay what algorithms did I use um we are going to talk about uh security okay so I've kind of made choices here **[06:17]** that are are comp are compromises but they're in service of not getting compromised okay they're of they're in service of not um service of not actually getting hacked okay So what what does that mean? Uh stuff like vulnerability um mitigation. Um stuff like uh model des serialization. Okay, we'll talk about that what that means. Um and uh stuff like um uh provenence. So where you get your uh what data um so you know where **[06:50]** the thing came from and the information actually about it. Okay, we'll talk about what I mean by providence. It actually means a couple of different things. [snorts] So talking briefly about the tools. So what tools are we talking about here? Um they are um one uh these are the so basically we're building uh a pipeline. What do we have? What are we going to use end to end? Okay. And so there are some compro compromises in here. You might be like wait a minute one pass that's not a uh production tool. Okay. So this is in service of kind of getting hands on the entire pipeline from end to **[07:20]** end and emphasizing security. Okay. So what have we used? We've used uh PyTorch because it allows us to use one container for inference and uh and training. That's a you know popular uh uh AI framework. Uh we've used Prefect for workflow orchestration and that's a great tool because it kind of scales from you know a nice local pipeline all the way to production to being a a pretty serious production tool. Uh we've used uh safe tensors and we'll talk about what that is. Um instead of pickle files, we'll get into how much I hate **[07:52]** pickle files in a minute. Uh we'll get into we'll get into uh and then a few other things. So gripe for scanning and chain guard which you know we're chain guard chain guard images for your secure container infrastructure. Okay. And then we did you you know it's very important to manage your secrets and not you know even even environmental variables. It's like okay well it's better than putting you know a key in a file but you should really be using something serious for your secrets management. That's a great way to get uh compromised is to leave **[08:22]** long lived uh API tokens lying around. So you got to use something uh that actually you know an actual enclave an actual uh system that manages those. So since this is a local build I've used one pass which is kind of like an acceptable in this context but you should really be leaning on say for example your CI/CD um for best practices in there. Okay. As long as you you're kind of like committed to not having the key lying around you should be able to figure it out. Okay. So, I'm going to go on a little rant here, so flame on. Um, but basically, I think that the state of **[08:55]** tooling in Ma uh ML pipelines in 2025 is uh not great when it comes to security in some ways. Other ways, it's maturing. It's getting better. Um, you know, we have some other issues. There's a lot of tool proliferation. Maybe there's a lack of standards. Formats continue to be a big problem. Um, but uh in specifically in this area of security, the tooling really doesn't encourage best practices. And what does that mean? Basically, if the ecosystem is not mature, if the ecosystem is mature, you can burn down a **[09:26]** list of of items, you know, you set up your tools in the standard way. As long as you don't do something really outlandish, uh or go way off the beaten path, the tools will um will sort of lead you to the correct conclusion. Uh will keep you secure, um make the system performant, whatever it is you're tracking. Um if the ecosystem is not mature, it's really much more on us or it's on you as the uh practitioner, as the you know MLOps, DevOps, uh dev, whatever title you have to um to be **[09:57]** critical, okay, and not to be complacent. Um and unfortunately, I would say in 2025, yeah, the system the MLOps infrastructure in this specific area, which is security, is not mature. Okay, I think this is the Adams family. So, it's a little lack of maturity there. [snorts] Uh there's only so many there's a lot of Frankenstein memes out there, but uh the uh so this is not very scientific, but it's Google engrams. I don't know if people ever use this just to get like a gut check on some what's how popular something is. Um but basically it's how **[10:29]** much is uh DevOps versus MLOps being talked about. And uh you can see MLOps is still kind of on the upswing. DevOps had its, you know, had its moment of of growing and MLOps is also growing. Um, but it's uh, you know, MLOps came out of DevOps, but it, you know, has has its own concerns and we're still definitely in this process of maturing, standardizing, and making things a little more formalized. Okay. And of course, what does that mean? It means there's plenty of pitfalls in the **[11:00]** tooling. Okay. Uh, this is Ash and Army of Darkness falling into a pit, which is a GIF I think I could watch all day. Uh yeah, there he goes. Um so we want to avoid the pitfalls and uh and be critical and that often means not relying say if you have an AutoML framework, you might have to add extra steps in order to do the things that I'm talking about. Um if you're using a managed platform, then maybe you want to be bugging the people who are managing the platform. Uh and if you're in charge, well uh that's good. At least you have some purchase on the system. **[11:30]** You should be adding what I'm talking about to your system. [snorts] So let's get into the pipeline. A little gif here. It's 17 steps. A mere 17 steps, right? 17 steps is actually nothing when it comes to an ML pipeline. You could have you could have uh hundreds of steps. This is actually I would say a very simple ML pipeline. Um but a lot of these steps are a little more concerned with um with secure sec more security than uh you might imagine. So what I'm going to do is we're going to go into demo mode here. Um, and we are going to take a look at the uh **[12:01]** repository and and run the demo and we'll see if it blows up or not. Um, and then as it runs the unfort the gripe scans take quite a while. So I may switch back to the presentation depending on how bored we get. Um, but it's kind of fun to watch. I personally like watching a pipeline complete. I think if you're in MLOps, if you're in dev devops and you don't like watching a uh you know node spin up or a uh or a pipeline uh go from step to step, then I don't know why you got into this business, you know, cuz that's the that's the fun part of the business when things are sort of working. Um but uh **[12:33]** otherwise, it's just looking through logs to see what what went wrong, right? But but let's go into it. So [snorts] you can go to bit.ly/frankenpipe ly/frankenpipe. If you um have a laptop in front of you and you have itchy fingers and you want to be doing something, you can that will bring you to a GitHub repository which has the uh you know it has a file for the presentation. It has all the memes in the presentation as well and it has a folder called pipeline which has all of the uh pipeline stuff for lack of a better word. Okay, so uh you uh there's **[13:04]** a read me with how to get set up. Probably the hardest part uh I would say you know clone it and take a look. you may have a hard time getting it to run like right now um just because if you're if you're running one pass on your machine it'll be a lot easier but um but you know the hardest part is probably making sure you connect correctly to one pass you'll need to put a um a token a for the image generation we'll talk about where you know the data synthesis for the uh for the data pipeline part in a minute but basically we're generating **[13:34]** data using um using the openai API so you'll need an API key for that. Okay. Um, so what does the pipeline do? Um, before we get into it, uh, and then we'll we'll, uh, start it running and I'll actually it's it's probably good to get it running and then I can get have something to do. But the short version is it's a um it's a classifier that will classify between spooky and non-spooky images. Okay. Um, funny enough, you know, I told you I didn't emphasize the **[14:05]** hyperparameters and all this kind of stuff. It it definitely uh and it it thinks all botanicals are spooky. So, anything is that's a tree, anything that's a plant, it thinks is spooky. To be fair to the model, this was supposed to be one of the non-spooky images. Like, it's like, oh, a bright forest scene. I find it a little spooky now that I know it's been classified as as spooky. So, so maybe the model is not that far off, but but there's definitely some some alpha here in terms of like getting getting the uh the model, you know, bump up the epoch, change the hyperparameters, change the change the **[14:36]** training data. Okay, it's not perfect, but we're emphasizing security here. So, let's get this thing running. [snorts] You know, you can't do a demo without without a now discontinued split keyboard. So, uh All right. So, got a nice blank slate here. I'm opening the command line. Get a nice dark theme **[15:08]** here. And I'm going to CD into my projects. Going to CD into frankenpipe. Um now we are going to go into pipelines. Uh before we start since uh a couple of the steps require browser um like for key signing and stuff like that. So I'm going to open a browser just so it opens up in the right works workplace here. I'm trying to think if there's anything else I need to set up. I'm going to make sure one password is running. It is. And I think we're Oh, and one other step. **[15:39]** Yeah, we So, there's this very cool ML um uh workflow orchestration tool that we've used for this. It's called Prefect. Um so, what we uh you don't always have to start the server, but things sort of work better if you do. So, we're going to do that. We're going to start the prefix server. So, I'm going to open a new terminal. Go to the project. So, we have the right virtual environment loaded up. And I'm going to do prefix server start. **[16:10]** So, what is this doing? Basically, Prefect will keep track of all of your runs, which is very nice. Um, so if you have different projects you're working on, it keeps track of all the different ones. Takes a little minute for it to spin up. Then it opens a um like a local environment, like a local little website uh where you can track your runs and everything. So, I we probably won't be referring to that much, but we can open it up. Why not? All right, we got our little we got our **[16:40]** little setup here. Making me feel like I have a little command center going. We got our server running here. This is the prefix server. And now in this uh terminal, I'm going to run the demo. So, what we're doing here to get everything started is there's a a folder with flows. So, all the different um workflows that will be run. These are things like signing the containers, building an inference container. We'll talk about all these different things it does, but the flows folder has all these different tasks. And we kind of kick it all off by running the main flow. So, let's do Python **[17:11]** flows main py. And the first thing it's doing now is asking me for u my you know to authenticate with one password. Now what what was that needed for? It's um we uh we'll talk about the where we got the data and like data choices in a minute but basically we're we've chosen to synthesize data which is a very **[17:42]** secure way of getting data. It has some other problems maybe related sometimes related to um aligning to your business uh uh use case with the ML pipeline but it's certainly one of the more secure ways. So, and since we're making security decisions here, we've synthesized data. So, we're creating a data set for training where we have a set of 50 spooky and 50 non-spooky training images. And then we have I think another say like 20 for validation. Um, and these all get placed into a data folder. Um, so we generate those and then it's going to um build uh **[18:15]** gather grab a secure container image. We're going to talk about where those come from and how who provides them. That's chain. That's us. um make this a little bigger so it looks looks nicer. Um then it builds uh a version of those images that has safe tensors and we're going to talk about safe tensors now too in a minute. Um once it builds them, it scans the containers for known vulnerabilities. Then it signs the containers. Um and basically every artifact in this pipeline we uh we sign after we create it. So after we create the images before using them, we're **[18:47]** going to assign them and check it. Um, and we're gonna also after we uh train the model, we sign it, okay, before we move it to the next stage and run it in inference. We're going to talk about why that's important in a minute. Um, and now the Gribe scan, I believe, yeah, should be started. The Grie scan is what's going to take a while. Gripe is a scanner and uh that checks for CVE. So, we're going to run on that. Uh, you'll see now in a minute the uh we'll I'll have to do some keyless signing uh using a browser. So, but I'm going to go back to the presentation and run through a **[19:19]** few of the uh sort of decisions we made here. But you'll see we'll get interrupted when I have to do the keyless signing. Okay. Uh so let's talk uh let's talk about the data provenence part. Okay. And uh Snow White's going to get kind of blasted here in a second when I have to do some keto signing. So don't get too surprised in a minute. Um but uh the first step in an ML pipeline is generally speaking gathering the data. Um and unfortunately **[19:50]** this is a very already a very fraught stage like we at step zero. Here we go. So I got it. Okay, I think we signed to Yeah, great. More stuff is going to pop up. I'll just leave. There we go. [laughter] So, we're signing two things. We're **[20:22]** signing the uh training we're signing the training and inference containers. And then in the pipeline um in the pipeline once you we have those ready it's going to actually run the training. Okay, it runs through 10 epochs which is not very much and then once the model is created um it's going to uh save it in safe with safe tensors and then it's also going to sign that. **[20:53]** So we're going to have to do that process three times. Um yeah it doesn't have to be interactive. It's just you know this is a local workflow and it's a demo. I wanted things to be obvious what was going on. But you can definitely use uh with with cosine, which we'll talk about in a minute. You can use uh token or whatever. It definitely work in your CI/CD. Um uh and I'm kind of waiting for that last one to kick off, but that's fine. We'll go back and I'll get interrupted one more time. [snorts] Yeah. Go ahead. **[21:23]** To generate the Yes. Okay. So since we're on that step, um I have used just just regular Gen AI. Um I believe I think I might have switched. It's either the anthropic or open AAI image API. I think it's open AI in this case. Um so you could take a look in the um in the the folder. But uh but basically what we're doing is we I uh used AI to create 50 prompts. Okay? So of spooky and non-spooky things. Um, **[21:54]** and then like one of the issues there of course was uh that a lot of the spooky ones had botanical. It's like a creepy tree, a creepy plant or whatever. Um, but it created uh 50 images and then validation images as well. Okay. Okay. I think we're mostly past the point of being interrupted, so we can go back to the nice [snorts] and we'll check I'll check back on the pipeline in a second. **[22:37]** presentation. All right. So, where do you get data from that's safe? Okay. And there's a couple of answers to this question. Um, and I would say I'm going to outline four. I'm sure there are other ways of creating data. Um but for practic four is a practical answer that I've seen and that is uh one you can uh you can uh find the data in like a curated data set. Um that I would say is often kind **[23:08]** of a bit of a target. So it's it's not as secure as it sounds cuz I think these are juicy targets for people who want to poison uh data sets. Uh you can uh you generate data through your own uh business actions. you know, business intelligence. So, say interactions with customers, um, that kind of thing, as long as you keep track of the data and you're securing it correctly, that's a great way and pretty secure way to generate data for ML pipelines. Um, another one that's very tempting to use is userenerated content, UG, UGC, and **[23:40]** that's, for example, like say you're scraping Reddit comments or something like that, or you're going out in the open web and you're finding text, you're finding images. Um, that's very tempting. It's very you can often be very aligned with your business goals, but um but it's also kind of trivial for folks to kind of like plant stuff. If they suspect that you're going to do that or they know that you're doing that, they can plant things that will uh result in a compromised model. Okay, they can do data poisoning and then um then you can synthesize uh data. You can **[24:10]** also kind of in some cases do a hybrid approach. Uh sometimes UGC combined with synthesized data is a is not a bad approach because if you trans some kind of transformation um on on uh UGC it becomes a uh harder for folks to do a uh data poisoning attack on you. So what does a data poisoning attack um look like? It could be as simple as folks putting like a um a purple square in an image um and then tagging it a certain way and then that means that they could trigger a model to **[24:41]** have behavior against how you intend it in production. Okay. And it can be as little as one image in a lot of cases will trigger this kind of um will you know data poisoning attack. Um all right so once you have the data you need to train the model and you need a uh base model and then you also need to save the model yourself. Um and right now u probably I wouldn't say it's the most standard I'd say it's the most maybe the most common um format for model storage for model serialization is **[25:11]** uh pickle files. Okay. And what are pickle files? They're basically um uh op a bunch of op codes like low-level machine instructions in a file and when they get deserialized when they get loaded in and when those codes are run in order to load in the model um then arbitrary code uh can be run at that time. So deserial deserializing a pickle is kind of a very fraught uh process. So I would say generally speaking don't do not trust pickles. Um and uh what are the alter alternatives here? What do you **[25:42]** do instead of pickles? You can do TensorFlow uh various TensorFlow formats. There's actually quite a few. Um TensorFlow 1, 2, uh light, etc. Um Jax is another format. One I've used here. The one I've chosen is safe tensors. That's a format u created by hugging face. Uh I recommend it. It's it's uh it's not included. It's not used by default by PyTorch, but you can get it to work with uh frameworks like PyTorch pretty pretty straightforwardly. If you have to use a pickle file, I recommend sandboxing it. Okay. And then **[26:12]** des serializing it in the sandbox and transferring it to another uh format that can't run arbitrary code and then loading that in your pipeline. Okay. But if you can avoid it, avoid it. In this case, we've used a base model um that was uh shared by Microsoft. Um it's ResNet 50 which is a very standard image um classification model. how and are used for image classification and it's actually shared in safe tensors format. Okay. [snorts] **[26:45]** Um then once you have your base model, you have your data, now you need uh a framework such as PyTorch. Okay. But there are other, you know, TensorFlow is another big one. There's a whole lot of other frameworks. Um then you need a your infrastructure, your framework to actually run the workload. Okay, so in the modern day in 2025, your workload should be containerized, broadly speaking. Um, why? Because it makes them reproducible. Um, it's a boundary that you can like use to scan. Um, it'll work **[27:17]** in a lot of different environments. It helps orchestration. So there's a lot of reasons to use containers and um, but unfortunately a lot of AI containers in particular, I mean honestly this is problem for all sorts of containers. That's uh, Dark Souls. Someone's getting eaten by a mimic which is like a scary box container. [snorts] Uh this is also Dark Souls. So in AI the frameworks are enormous and the container images are also enormous. Okay. Um that means there's a lot of uh uh attack surface in these containers **[27:49]** and unfortunately uh these uh containers are typically the if you just grab a an upstream uh pietorch the official PyTorch image like dockerpole pytorch/pytorch it's going to have hundreds of known vulnerabilities cvees uh what is a CVE it is a common vulnerabilities and exposures they are a uh formal it's a formal system for reporting and detecting known vulnerabilities in software. Vulnerabilities are just flaws in a system that can allow the system to **[28:20]** be compromised. Okay. Um known vulnerabilities are ones we know about and CVEes are ones that are registered in uh like say for example NVD, the national vulnerability database. That's one database that stores um CVEEs. Okay, so they're tracked CVES. You definitely want to get rid of CVEes because if you're running a certain version of software, an attacker can just come look at the version that you have and say, "Oh, well, what CVS are available for this." It's basically a menu of attack options for them. So, you definitely want to remediate CVES. And it's also important if you want to like say work **[28:50]** for the work with the federal government. Um, but it can be very hard to remove CVES because say you pull an image um and it has six critical CVEes. It's like well okay but h uh three of them are in the underlying OS say it's running on iuntu now you have to fix iuntu um or you know maybe the rest are in the language runtime they're in Python you're going to fix upstream Python I mean you can people do um but it's a lot of like kind of relentless work and uh so what we do at Janggard is **[29:21]** we have our own uh secured uh containers uh these these you can pull and play around with them docker pull cgrdev for/chainguard forge/pytorch for example and uh and play around with it and you can scan it and you can see it has very few or no CVES on any given day and we started from the very beginning we just have uh our our uh open source OS wolfie and then a version of that chain guard OS that uh that is designed from it's a rolling dro everything's bleeding edge **[29:52]** it's designed from the ground up to be secure um so that you're building on something that doesn't already have CVS when you pull it so we've used chain guard in our pipeline. [snorts] And uh and then a big part of that um of staying secure and avoiding known vulnerabilities is scanners. Um and that's kind of what took a while in our pipeline. We're going to cut back to our pipeline in a second, see how it how it how it uh uh concluded. And uh a big part of it is after we built the images, you know, the only thing I added to the images was safe tensors. Okay? So I I **[30:23]** downloaded chain grid images. I added safe tensors in in a build. Once I did that, I signed them. Okay. Um, we'll talk about signing in a second, but then we scan them and scanning will tell you how many CVEs there are. So, we generates a report saying how many CVEes, how many known vulnerabilities are in uh that infrastructure. Okay. Um, so before we go back to our pipeline and see that, you know, it exploded in my face or whatever, let's do uh talk about signing. I've mentioned it a few different times and uh signing is uh it's we actually **[30:54]** have great uh tools around signing. it's they're just not sort of encouraged or built in to you know tools other structures like AutoML tools platforms uh managed platforms other kinds of tooling don't kind of automatically encourage you to sign why is signing important uh a lot of attacks these days they're supply chain attacks okay like the big attack on the npm ecosystem recently and uh they tend to or the ultralytics attack in December 2024 on ultritix yolo that was in the Python e **[31:24]** ecosystem these These are attacks that often compromise different parts of either the build or distribution system of an upstream repository. Um and because uh often the the another way they get uh compromised is that when some artifact gets moved from one part of the pipeline to the other then uh people manage to insert themselves. Okay. So if you sign it makes it a lot harder to leverage one uh one compromise of a specific component of a pipeline into compromising the the output of the **[31:56]** pipeline you know the final product or the inference or the model or whatever comes at the end. Okay. So if you sign your artifacts and it's like oh but I'm not sending it to end users. Sign it definitely for your end users. If you're distributing a model you should definitely sign it but also sign it for so you receive it at the next part of your pipeline. Okay, so this is very important and it really does uh improve your security posture and if you're um have vendors who are providing models to you, if you have vendors who are providing infrastructure like container images, other software artifacts, um you **[32:28]** should encourage them to sign. Okay, it's signing is cheap. It's kind of an open source. So co-sign is part of SIGST store. It's a great open source project and uh just have people you know encourage people folks to use that okay use that infrastructure um and sign so scan and sign. So we're going to sum things up but first we'll look at our model at our uh at our output of our ML pipeline. Okay. [snorts] **[33:03]** So, it should have actually concluded. Let's take a look at the reports. So, I'm of course going to use Emacs for this [laughter] because why not? It's my favorite file manager um projects and we'll go to Frankenpipe. And we'll go to um pipeline. [clears throat] And then there should be reports. And you can see I've had to generate quite a few reports and and I'm like, **[33:35]** oh, should I generate them in markdown? Should I generate them in JSON? Well, why not generate both? You know, JSON for the tools, markdown for me. And you can see inference at the end. Oh, and each of these is a different run. So I sim linked to the latest run just for my own convenience. And uh we can look and we can see say the inference uh report and it says oh well your inference is actually pretty bad because it thinks about that you know the spooky botanicals. Um but the signing reports **[34:08]** you know we have also have reports for each signing and receiving the signatures and who signed it um and when. So I'd also say for observability I mean there's plenty of good observability platforms and stuff like that. Um but you know also generating reports is cheap scanning is relatively cheap. You know there's it takes a certain amount of compute. Um signing is super cheap. Uh using uh safe tensors or another safe format is it's definitely worth it. There's a little bit of annoyance involved maybe with you know **[34:38]** converting a pickle file or something like that. Um, but there's some annoyance, but you should. It's definitely worth it. So, all of these things trying to pull up the uh the final the final slide here. Sorry. **[35:14]** We actually see our work our run here. Well, I'll pull it up in a second, but I'll just conclude before I do. Um, so you know, summing things up, you should sign. You should use uh safe formats for models that aren't pickles that don't allow random uh or uh arbitrary code execution. You should sign um and you **[35:45]** should use secure infrastructure. Uh if you scan, you'll at least know how many CVEes are in your containers. If you're doing a weekend project or something, you can pull our Docker images. So cgr.dev/chainguard/pytorch. Okay. Um, I'm going to pull up uh some resources with QR codes in a second once I actually, you know, uh get the get the deck back up, but I don't know where I went. And uh but let's start the maybe we'll we'll uh you know, conclude the talk and start the uh the Q&A. Okay. Thank you. [snorts] **[36:28]** Can I have a little volunteer or um do we have another mic or uh can a volunteer kind of bring this around and I'll going to bring up this the last slide here so you can have some resources? Um does anyone feel like they want to Okay, cool. Do you want to just bring it to people so they can ask Q&A? Thank you.