What security practices are specific to operating LLM systems (supply chain and runtime)?

30-second answerSay your answer out loud first, then reveal.

Secure the supply chain (vetted model sources, pinned revisions, safe weight formats, signed artifacts, dependency and container scanning, licence checks), protect runtime secrets and data (no secrets in prompts, gateway-held keys, PII redaction, tenant isolation), defend the application layer (prompt-injection mitigations, least-privilege tools, output sanitisation before rendering or executing), sandbox any code execution, and monitor for abuse (anomalous usage, extraction attempts, cost attacks). Include all of it in threat modelling and regular red-teaming.

Checklist

Layer	Controls
Models	Trusted sources, pinned revisions, safetensors, hash verification, licence review
Dependencies	SBOM, vulnerability scanning (Python packages, inference engines), pinned versions
Containers	Minimal images, non-root, image signing, regular patching
Secrets	Secrets manager, gateway-held keys, rotation, secret scanning
Data	Encryption, PII redaction in logs, tenant isolation in indexes and caches
App layer	Injection defences, tool permissions, output encoding (prevent XSS from model output), parameterised queries
Code execution	Sandboxes (gVisor / Firecracker / containers without network), resource limits
Abuse	Rate limits, anomaly detection (scraping, prompt extraction, token-burning attacks)
Process	Threat modelling per feature, red-team before launch, security review for new tools

Notable risk: model output treated as trusted input to other systems (SQL, shell, HTML). Always validate and sanitise it, as you would user input.

PreviousWhat does an incident response process look like for LLM applications?

You understood something today that you didn't yesterday.

What security practices are specific to operating LLM systems (supply chain and runtime)?

Checklist

Related