18.1 Protecting AI Systems from Data & Model Exfiltration

Google Cloud Professional Machine Learning Engineer PMLE

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & the Agent Platform Map

1.1 PMLE Exam Facts, Policies & the June 2026 Blueprint 1.2 From Vertex AI to Gemini Enterprise Agent Platform: The Product Name Map

2 Chapter 2: Low-Code ML with BigQuery ML

2.1 Choosing, Training & Predicting with BigQuery ML Models 2.2 Feature Engineering & Feature Selection in BigQuery ML 2.3 Fine-Tuning & Evaluating Gemini Models from BigQuery

3 Chapter 3: AutoML & Google Cloud AI APIs

3.1 Training Models with Agent Platform AutoML 3.2 Building with Document AI, Vision, Translation & Other AI APIs

4 Chapter 4: Foundation Models in Model Garden

4.1 Evaluating & Selecting Models in Model Garden 4.2 Building & Tuning Solutions with Gemini, Imagen, Veo & MaaS 4.3 Optimizing Gemini Applications for Cost, Latency & Availability

5 Chapter 5: Exploring, Preprocessing & Protecting Data

5.1 Organizing & Exploring Tabular, Text & Image Data 5.2 Choosing a Preprocessing Tool: BigQuery, Dataflow, Spark or Python 5.3 Creating & Consolidating Features in Agent Platform Feature Store 5.4 Protecting PII & Sensitive Data in ML Workflows

6 Chapter 6: Notebooks, Prototyping & Experiment Tracking

6.1 Workbench vs. Colab Enterprise: Secure, Collaborative Notebooks 6.2 Prototyping with PyTorch, scikit-learn, JAX & Model Garden in Notebooks 6.3 Experiment Environments, Tracking & Lineage with Experiments and ML Metadata

7 Chapter 7: Evaluating Predictive & Generative AI Solutions

7.1 Evaluation Metrics for Predictive Models 7.2 Evaluating Gen AI: Computation Metrics, Rubrics & LLM-as-a-Judge

8 Chapter 8: Choosing the Modeling Approach

8.1 Choosing the Model Type: ARIMA, Trees, DNNs & LLMs 8.2 Choosing the Product & Deployment Strategy 8.3 Modeling Techniques for Interpretability Requirements

9 Chapter 9: Training Data & Training SDKs

9.1 Organizing & Ingesting Training Data from Cloud Storage & BigQuery 9.2 Custom Training on Agent Platform: Containers, Jobs & Worker Pools 9.3 Kubeflow on GKE, AutoML & Tabular Workflows as Training Choices

10 Chapter 10: Troubleshooting, Hyperparameter Tuning & Fine-Tuning

10.1 Troubleshooting ML Training Failures 10.2 Hyperparameter Tuning on Agent Platform 10.3 Fine-Tuning Foundation Models & When to Tune

11 Chapter 11: Training Hardware & Distributed Training

11.1 Choosing CPUs, GPUs & TPUs for Training 11.2 Distributed Training: Data & Model Parallelism

12 Chapter 12: Deploying Models for Inference

12.1 Batch vs. Online Inference on Agent Platform 12.2 Serving Beyond Agent Platform Endpoints: Model Garden, Cloud Run & GKE 12.3 Prebuilt & Custom Serving Containers

13 Chapter 13: Model Versions, Rollouts & Inference Logic

13.1 Organizing & Versioning Models in Model Registry 13.2 Rollout Strategies: A/B Tests, Canaries & Traffic Splits 13.3 Inference Preprocessing & Postprocessing

14 Chapter 14: Scaling Online Serving

14.1 Serving Features Online with Feature Store 14.2 Public, Dedicated & Private Endpoints 14.3 Serving Hardware & Autoscaling for Throughput 14.4 Tuning Models for Production Training & Serving

15 Chapter 15: End-to-End ML Pipelines

15.1 Validating Data & Models in Pipelines 15.2 Agent Platform Pipelines with KFP: Components, Templates & Caching 15.3 Ensuring Consistent Preprocessing Between Training & Serving

16 Chapter 16: Orchestration with Managed Airflow & Ray

16.1 Orchestrating ML Workflows with Managed Service for Apache Airflow 16.2 Ray on Agent Platform for Distributed ML Workloads

17 Chapter 17: Automating Retraining & CI/CD/CT

17.1 Choosing a Retraining Policy 17.2 CI/CD/CT for ML with Cloud Build

18 Chapter 18: Securing AI Systems, Responsible AI & Explainability

18.1 Protecting AI Systems from Data & Model Exfiltration 18.2 Defending Gen AI Apps: Safety Filters, Model Armor & Regex Guardrails 18.3 Responsible AI: Detecting & Monitoring Bias 18.4 Model Explainability on Agent Platform

19 Chapter 19: Monitoring AI Solutions

19.1 Configuring Model Monitoring on Agent Platform 19.2 Training-Serving Skew, Data Drift, Concept Drift & Attribution Drift 19.3 Monitoring, Testing & Evaluating Gen AI Solutions in Production

18.1 Protecting AI Systems from Data & Model Exfiltration

Key Takeaways Explain This Topic AI

A VPC Service Controls perimeter around Agent Platform keeps training data, models, online inference requests, batch inference results, and Gemini models from leaving the perimeter.

Adding Agent Platform to a VPC Service Controls perimeter blocks public internet access to it unless callers are explicitly allowed.

Google recommends the restricted VIP with Private Service Connect for Google APIs or Private Google Access for private, perimeter-compatible access to Google APIs.

Customer-managed encryption keys in Cloud KMS give control over key location, rotation, access, and cryptographic boundaries for Agent Platform resources.

Least-privilege service accounts for training jobs, pipelines, notebooks, and deployed models limit what a compromised workload can read or copy.

Last updated: September 2026

Section 6.1 of the exam guide asks you to build secure AI systems by protecting against unintentional exploitation and leaks of data or models (for example, data exfiltration, malicious prompting, and sharing sensitive data with LLMs) . This section covers infrastructure controls against exfiltration. Section 18.2 covers prompt-level defenses.

What Can Leak, and How

Asset Leak path examples

Training data Copied to an external bucket, exported from a notebook, pulled by an over-privileged service account

• Model artifacts (weights) Downloaded from Cloud Storage or exported from Model Registry to another project
• Online inference requests and responses Logged to unprotected tables, sent over public paths
• Batch inference results Written to buckets outside the organization

Prompts and RAG context Sensitive documents indexed into a chatbot anyone can query, or pasted into unapproved tools

• The model's behavior Model extraction through high-volume querying of a public endpoint
• Layer 1: Identity and Access (IAM)

Least-privilege roles: give data scientists viewing and running permissions (for example, Agent Platform User , roles/aiplatform.user ) rather than Agent Platform Administrator ( roles/aiplatform.admin ), and restrict who can export models or change endpoints.

Custom service accounts for training jobs, pipelines, deployed models, Workbench instances, and Ray clusters, each with access to only the buckets, tables, and secrets it needs. Don't rely on broad default service accounts.

Separate projects for development and production, so experimental notebooks can't read production data by default.

No long-lived keys: use service account impersonation and workload identities instead of downloaded JSON keys.

Secret Manager for API keys and credentials used by pipelines and serving containers.

Layer 2: VPC Service Controls Perimeters

VPC Service Controls (VPC-SC) creates a service perimeter that is independent of IAM. Even a user or service account with valid IAM permissions can't move protected data out of the perimeter.

When Agent Platform is protected, these artifacts can't leave the perimeter :

• Training data for AutoML or custom models
• Models you created
• Online inference requests
• Batch inference results
• Gemini models

Put BigQuery, Cloud Storage, Agent Platform, Artifact Registry, and Dataflow (and any other service the workflow uses) inside the same perimeter. Adding Agent Platform to a perimeter blocks public internet access to it, including console and programmatic calls, unless the caller is inside the perimeter or on an access level allowlist, such as corporate IP ranges.

Private access to Google APIs

Option Use

Private Service Connect for Google APIs (with the restricted VIP bundle) Private API endpoints with a custom IP and DNS name, and on-premises access over hybrid networking

Private Google Access with the restricted VIP Private route to Google APIs from VMs without external IPs

Google's best practice is to use the restricted VIP so requests to protected services never cross the internet. Some producer services that use private services access (such as custom training data plane, Pipelines, private inference endpoints, and Vector Search queries) need extra network configuration inside VPC-SC.

Endpoint choices under VPC-SC (Chapter 14)

Private Service Connect endpoints support VPC-SC. Dedicated public endpoints don't .

Model Armor regional endpoints accessed from a VPC need a Private Service Connect endpoint to the Model Armor APIs to avoid certificate errors with Private Google Access or VPC-SC.

Layer 3: Encryption and Key Control

Default encryption at rest covers Agent Platform content automatically.

CMEK (Cloud KMS keys) gives control over key location, protection level, rotation, and access . Disabling a key blocks access to data encrypted with it. Supported across training, models, endpoints, pipelines, Workbench, Colab Enterprise, Feature Store Bigtable online stores, and more (check each feature).

Confidential Computing (for example, Confidential VM for Workbench) protects data in use .

Layer 4: Organization Policies and Governance

Custom organization policy constraints on Agent Platform resources (for example, training, inference, and pipelines) to restrict allowed configurations where supported.

Model Garden organization policy to allow only vetted models.

Data residency: restrict resource locations. Avoid the Gemini global endpoint when processing location matters (Chapter 4).

Access Transparency logs show Google staff actions on your content where supported.

Layer 5: Detection and Auditing

Cloud Audit Logs for administrative actions (model export, endpoint changes, IAM changes) and data access where enabled.

Alerts on unusual exports, new external buckets, or sudden spikes in prediction volume, which may signal model extraction.

Rate limits and quotas on public-facing inference to slow scraping.

Gen AI-Specific Leak Paths

Risk Control

Employees pasting confidential data into consumer AI tools Provide an approved enterprise gen AI application with data governance, plus policy and training

RAG chatbot exposing documents users shouldn't see Enforce document-level access control in retrieval, and don't index what the audience can't access

Sensitive data in prompts or responses Model Armor Sensitive Data Protection filters, and redaction before sending (Section 18.2)

• Prompt and response logs holding PII Restrict and expire log tables, or log de-identified content
• Tuning data containing secrets Scan with Sensitive Data Protection before tuning (Chapter 5)
• Worked Scenario

A pharmaceutical company trains models on clinical trial data and serves predictions to internal apps. Requirements: no data or models may leave the company's control, even if credentials are stolen.

Put BigQuery, Cloud Storage, Agent Platform, Artifact Registry, and Dataflow inside one VPC-SC perimeter , with access levels for corporate networks only.

Use Private Service Connect for Google APIs with the restricted VIP from on-premises.

Serve models from Private Service Connect endpoints .

Run training, pipelines, and notebooks as dedicated least-privilege service accounts , and apply CMEK with keys in the required region.

Enable audit logs and alerts for model export and IAM changes.