MLOps Engineer interview question
How do you secure the model supply chain?
Secure the model supply chain with trusted data sources, isolated builds, pinned and scanned dependencies, signed datasets and artifacts, provenance attestations, least-privilege registries, approval policies, and deployment verification.
Direct answer
What a strong answer covers
How it works
The model supply chain is everything between raw data and a model answering requests, and each link can be tampered with. Data comes from sources with known owners and is checked for poisoning. Training runs in isolated builders with dependencies pinned by hash and scanned. Datasets and model artifacts are signed, and provenance attestations record which code, data, and environment produced each artifact. The registry enforces least-privilege access and approval policies for promotion. Serving verifies the artifact signature before loading, refuses unsigned or unpinned models, and loads only safe formats rather than executable serialisations.
Example
Models are trained in ephemeral CI runners with a locked dependency file, exported in safetensors format, signed with Sigstore, and registered with a SLSA provenance attestation. The serving image verifies the signature and the attestation at startup and refuses to load anything else. A supply-chain drill that tried to promote a model built outside CI was blocked by the registry policy.
Common mistakes
- Loading pickle files that execute arbitrary code from a shared bucket.
- Letting anyone with write access to storage overwrite a production model.
- Installing training dependencies from unpinned ranges in the build.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.