Use Case: AI Security
Model and training data exfiltration
A researcher downloaded 47 GB of fine-tuned model weights to an external hard drive 4 days before starting at a competitor. ManySignal correlated the ML platform access with the departing employee flag.
When the IP is weights, not code
As organizations invest millions of dollars in AI model training, the trained model itself becomes valuable intellectual property — comparable to source code for a SaaS product or a proprietary algorithm. The model weights encode the investment in compute, data curation, and RLHF tuning. For organizations building AI-native products, these weights are crown jewel assets that deserve the same protection as production database backups or core source code.
Model exfiltration is an emerging threat category with limited security tooling coverage. ManySignal addresses it by monitoring ML platform APIs, model registry access patterns, and large file transfers involving file types associated with model storage (.safetensors, .bin, .pt, .ckpt).
rule: model_weight_exfiltration
type: behavioral + dlp
sources:
- aws_s3_access_logs (model artifact buckets)
- huggingface_hub_api
- weights_and_biases_audit
- mlflow_tracking_server
- edr_file_events (.safetensors, .bin, .pt, .ckpt)
trigger:
- condition: |
model_file_access.external_transfer == true
AND file.extension IN [".safetensors", ".bin", ".pt", ".pkl", ".ckpt"]
AND transfer.size_gb > 1
- OR:
- condition: |
user.departing == true
AND model_registry.download_event == true
enrichments:
- model_classification: model_name, training_cost_estimate
- user_context: role, departing_flag, contractor_status
- destination: approved_mlops_infra vs external_storage
- volume_baseline: user_normal_model_access_pattern
mitre: T1048 (Exfiltration Over Alternative Protocol), T1213 (Data from Information Repositories)MITRE coverage
Model exfiltration FAQ
What makes model exfiltration a significant security incident?
A fine-tuned model represents months of training compute, proprietary training data, and the embedded knowledge of your organization's processes and customers. Exfiltration of model weights gives a competitor or nation-state access to: the implicit knowledge encoded in the training data, the fine-tuning adaptations that represent your product differentiation, and potentially the ability to reverse-engineer training data through model inversion attacks.
How large are typical model files and what exfiltration method would an attacker use?
Fine-tuned transformer models range from a few hundred MB (7B parameter models with LoRA adapters) to hundreds of GB (70B+ full fine-tunes). Exfiltration uses cloud storage transfer (S3 to an external bucket), model registry API calls, or ML training platform APIs (HuggingFace Hub, Weights & Biases). Each of these leaves an audit trail that ManySignal monitors.
Does this detection cover training data theft as well?
Yes. Training dataset exfiltration — whether the raw data (customer records, proprietary documents) used for fine-tuning or the processed dataset artifacts (JSONL files, tokenized datasets) — is monitored via the same data exfiltration detection workflow with ML-specific data type enrichment.
What access controls should protect model weights?
Model weights should be stored with the same controls as other crown jewels: object-level access logging, no public access, limited IAM access to specific MLOps roles, MFA enforcement for the ML platform accounts, and network isolation. ManySignal monitors for violations of each of these controls and flags when model weight files are accessed outside the expected MLOps workflow.
Protect your model weights like your most valuable IP
ML platform audit monitoring with departing employee correlation and large file transfer detection.