Deep explanation
Secure MLflow in a customer onboarding assistant
Staff security question: secure a self-hosted MLflow server behind an onboarding LLM app covering PII in traces, authentication and permissions, artifact store access, registry alias changes, unsafe model loading, and prompt tampering.
Quick answer
MLflow is part of the production supply chain here: it stores sensitive traces, and whatever model version or prompt the production alias points to becomes the assistant's behavior. I'd put it behind SSO and a network boundary, turn on per-experiment and per-model permissions, lock the artifact store so only the server can reach it, and redact personal data before traces are logged. Promotion of a model or prompt to production would require an approved, evaluated version changed only by a CI service account, with audit logs and alerts on every alias change.
The interview question
Your customer onboarding assistant is an LLM app whose prompts, models, evaluation runs, and production traces all live in a self-hosted MLflow tracking server and model registry. A security review flagged that traces contain applicants' personal data, anyone on the network can reach the MLflow UI, and a registered model version could be swapped to change the assistant's behavior. How would you threat-model MLflow in this system and lock it down?
Deep explanation
Simple explanation
Sign in to unlock the full answer
Free accounts include 5 full deep answers. Sign in to start unlocking.
- 19 more sections of deep explanation
- Real-world examples
- Common mistakes
- Interviewer expectations
- Follow-up questions