Skip to content

Changelog

All notable changes to the MLSecOps Guide are documented here.

[Unreleased]

[1.3.0] — 2026-10-22

Added

  • NIST Cyber AI Profile (IR 8596 iprd) — CSF 2.0 Community Profile mapping for Secure themes: Ch.11 section, Ch.15 appendix card, Ch.5 AI SBOM/GV.SC-02 note, Ch.8 AI NHI/least privilege (PR.AA), Ch.10 four-way AI traffic classes + IR metadata (dataset/hyperparams), academic CTI (ID.RA-02). Explicitly labeled preliminary draft — not a certification claim.
  • Ch.12 L6 — clarify NeMo Guardrails vs Meta Llama Guard vs Guardrails Hub LlamaGuard7B (archived hub repo).

Changed

  • Release decision wording — normalize across README, Getting Started, Ch.1–2, Ch.6, Appendix E: blocking release decisions at 4, 7, 8 (7 at Level 2+); mandatory integrity checkpoint at 9 before store/deploy (not conflated as a fourth “release decision” of the same type).
  • SOC / baseline privacy — co-locate privacy-aware prompt/response handling with MUST telemetry (Ch.6 minimum baseline, Ch.10 SOC prioritization and “only three controls”).
  • Navigation fixes — Ch.7 TOC (dedupe MCP; add LLM verification); fix Level 1 and AI Compute Hijacking internal anchors.
  • Scope clarity — handbook ≠ bundled CI product (Getting Started + README Implementation Reference note).
  • Dependencies — disable Dependabot (remove .github/dependabot.yml); track Action/pip bumps manually via maintainer PRs.
  • OpenSSF Best Practices — earned Passing (Metal) and baseline-2; README embeds both badges separately. Scorecard intentionally not used (documentation handbook).
  • Baseline-2 readiness — DCO (DCO.md + PR check), dependency/build docs in CONTRIBUTING.md, member/roles in GOVERNANCE.md, DESIGN.md, release integrity (RELEASE-INTEGRITY.md + manifest script + signed SHA256SUMS in Create Release workflow), expanded SECURITY.md (CVD public disclosure, secrets, repo security assessment).

Clarified (same version — reader confusion pass)

  • Getting Started — terms card (CP vs Level vs Evidence Pack), framework order, role paths (5 links each), Level 1 vs Level 2+ baselines split so production MUST is not mixed with foundational.
  • CP8 vs CP9 order — Appendix E.2 flow diagram/table corrected (release decisions → integrity checkpoint → deploy); Ch.6 decision card + Stage→control-point wording; Ch.1 / README / Ch.2 / Ch.11 policy examples aligned.
  • Glossary — Control point, Release decision, Integrity checkpoint, Maturity Level; Baseline (metrics) ≠ minimum security baseline.
  • NeMo / Llama Guard / Hub — three-way distinction in Ch.12 skim tables + Ch.15 tool list.
  • NIST IR 8596 map — stronger iprd / non-certification lead-in; release row includes CP7; CP9 separated from Evidence Pack/AI-BOM themes.
  • Filled Evidence Pack sample — Appendix E.4 managed RAG example.
  • Ch.14 starting controls / Level tables — CP 9 managed-API alternative; TOC disambiguates repeated “Secure by design” / “Practical principle” labels.

Citation

[1.2.1] — 2026-08-15

Changed

  • Citation / Zenodo — version DOI 10.5281/zenodo.21950241 for v1.2.1 (concept DOI 10.5281/zenodo.21206780).

  • Diagrams — restore inline Mermaid fences from assets/diagrams/source/*.mmd alongside PNG fallbacks (29 diagrams); enable Mermaid rendering on MkDocs Pages. Appendix E _10–_21 remain SVG/PNG-first (no .mmd).

[1.2.0] — 2026-08-15

Changed

  • Citation / Zenodo — version DOI 10.5281/zenodo.21946726 for v1.2.0 (concept DOI 10.5281/zenodo.21206780).

  • Appendix E.7.3 Example C — deepen secure-by-design composition: caller→engine authN (not "to the GPU"); gateway serve-path authZ; gateway-overwritten vLLM cache_salt (CVE-2025-46570 / ≥ 0.9.0); safetensors allowlist with ModelScan on legacy formats; fail-closed admit + Kyverno HA; LoRA↔base_model_digest; MIG K8s-vs-VM wording; MPS not isolation; LeftoverLocals NVIDIA nuance + KV/VRAM hygiene; credential lifecycle; telemetry without raw prompts. Regenerated diagrams _16–_18.

  • Appendix E.7.3 / Ch.7 — gateway + prefix-cache trust break — engine key ≠ tenant PEP; omit cache_salt ⇒ global share even on vLLM ≥ 0.9.0; stable (not per-request) gateway-overwritten salt; reuse isolation ≠ capacity isolation; prefer crypto-safe prefix hash on shared replicas. Sources: vLLM prefix-caching docs, cache-salting RFC #16016, CVE-2025-46570.

[1.1.3] — 2026-07-26

Added

  • Ch.7 — KV Cache security — Transformer KV Cache primer (not a separate AI product); direct reconstruction threats (Inversion / Collision / Injection, KV-Cloak) vs cross-tenant prefix timing (PromptPeek); Cache-Augmented Generation (CAG) relation and durable-cache controls; maturity-labeled control table; cross-links from multi-tenant sections, Appendix E.1.3, and Ch.16 GPU isolation. Citations: Luo et al. NDSS 2026, Wu et al. NDSS 2025, Chan et al. 2024 (CAG).
  • Site / maintainer link — documentation site footer and home page link to mhsec.me.

[1.1.2] — 2026-07-25

Added

  • Ch.7 — Prompt injection defenses: from filters to architecture — L0–L3 defense layers (runtime filter, instruction hierarchy, spotlighting, Dual-LLM / structural patterns, IFC/capability); citations to Wallace et al. (2024), Hines et al. (2024), Willison (2023), Debenedetti et al. CaMeL (2025), Beurer-Kellner et al. design patterns (2025), Costa et al. FIDES (2025), AgentDojo (2024).
  • Secure by design sections (Ch.1, 4, 7, 8) — authorization- and output-channel defaults complementing the prompt-injection defense layers: assume-injection axiom and authorization-outside-the-model (Ch.1); no-direct-data-store-credentials / authorizing-service pattern (Ch.4); identity propagation with credential insulation, model-controlled-parameter constraints, intra-tenant vector-store RLS pre-filter, and zero-egress rendering (Ch.7); agent-never-selects-its-own-scope (delegated / NHI identity), credential insulation at the tool boundary, orchestrator-driven approval surface, and structurally-bounded autonomy (Ch.8); Appendix E.1.1 intra-tenant RLS access-model row and E.1.4 identity/data-access row; TOC Ch.8 title restored. Mapped to OWASP LLM01/LLM02/LLM06/LLM08, OWASP Top 10 for Agentic Applications (ASI02/ASI03/ASI08/ASI09), OWASP Non-Human Identities Top 10, RFC 8693, MITRE ATLAS, CSA AARM, and EchoLeak (CVE-2025-32711). (PR #5 by @ariangh001)
  • Tool maturity labels (Mature / Emerging / Research/Lab) in Ch.11–12 MCP/gateway tables; Evidence Pack MCP control worded as capability (static scan report), not a single product name.

Changed

  • Ch.8 agent defense layers and Ch.9 anti-patterns: detect-only injection defense called out; Appendix E.1.4 / threat-model template aligned.
  • Ch.15 bibliography and production checklist updated for design-level PI refs and MCP scan capability wording.

Fixed

  • GitHub Pages / sitemap URLs — after account rename, site_url, robots.txt, and docs links now use https://mhaghighian.github.io/MLSecOps/ (the old l4tr0d3ctism.github.io host 404s and broke Search Console sitemap reads).

[1.1.1] — 2026-07-16

Fixed

  • Issue #1 reference blocks restored — expanded compacted > *Refs - …* lines from PR #3 back to per-section ### References / Source mapping blocks across Chapters 1–17, keeping the corrected framework IDs and content from that review.

Changed

  • Community review merge (PR #3 by @Ali-Razmjoo): citation fixes (ATLAS/OWASP IDs), scope clarifications, Evidence Pack / maturity wording, Stage 3 naming, Ch.6 worked example, and related chapter edits.
  • Release packaging — PDF and DOCX are no longer attached to GitHub Releases or linked from the site; generate locally with scripts/build-docx.py when needed.

Removed

  • GUIDE-SUMMARY.md and related summary navigation/links from README, GETTING-STARTED, MkDocs, and GitHub Pages.
  • Pre-built PDF / DOCX download links from README, Getting Started, and release pages (build script remains).

Added

  • references/AARM-ALIGNMENT.md — complementary mapping to CSA AARM (Autonomous Action Runtime Management); links from Ch.8 and GETTING-STARTED.

[1.1.0] — 2026-07-11

Added

  • Per-section traceability (Issue #1) — References / Source mapping blocks on every major ## section across Chapters 1–17; traceability convention in Ch.15; CONTRIBUTING/GOVERNANCE expectations updated.
  • OWASP AI Exchange integration — complementary positioning and per-section source mapping where applicable: Ch.1 Exchange relationship; Ch.2 AI inventory + risk workflow; Ch.5 poisoning taxonomy + model theft paths; Ch.6 three test categories; Ch.7 augmentation data, downstream injection, verification gaps; Ch.12 periodic table cross-ref; GETTING-STARTED.md resource selector; Ch.15 Exchange citation.
  • Ch.1 — Why this guide matters — explicit reader value proposition, learning outcomes, and practical takeaways (Issue #2).
  • Ch.1 — Guide at a glance — audience, goal, outputs, and scope summary after Abstract.

Changed

  • Ch.1 — intro polish: transition sentence, split paragraphs, lifecycle lead-in, wording fixes per community review.
  • Ch.1–17 — framework source mapping audit: OWASP LLM/ML Top 10 IDs, MITRE ATLAS techniques, NIST AI RMF, ISO/IEC 42001, OpenSSF, and OWASP AI Exchange permalinks aligned to section topics.
  • GETTING-STARTED.md — Quick Start (5 Minutes), New to AI Security? path, renamed production baseline section, When to use this guide vs. OWASP AI Exchange.
  • TABLE-OF-CONTENTS.md — Ch.1 entries for Why this guide matters and What this guide adds; traceability convention; Exchange-related sections (Ch.1–2, 5–7, 12).
  • Ch.7 — removed duplicate augmentation block under Ingest security (cross-ref only).
  • Ch.12 / Ch.15 Appendix B — MITRE ATLAS table synchronized (AML.T0066, AML.T0034).
  • Ch.13 — LangChain case study: added CVE-2025-68664 alongside CVE-2025-27520.
  • prepare_pages.py — rewrite anchored GETTING-STARTED.md#… links for MkDocs; site index banner v1.1.0.
  • README.md — OWASP AI Exchange in frameworks list; version and download links v1.1.0.
  • Version strings aligned to v1.1.0 across Ch.1, TOC, README, CITATION.cff, CONTRIBUTING, GOVERNANCE, SECURITY, RELEASE_NOTES, and releases README.

[1.0.1] — 2026-07-05

Added

  • Zenodo DOI 10.5281/zenodo.21206781 for long-term citation.
  • Zenodo archival release — no guide content changes; triggers DOI after GitHub–Zenodo integration.

[1.0.0] — 2026-07-05

Added

  • GitHub Release v1.0.0 with DOCX and PDF (MLSecOps Practical Reference Guide).
  • Printable editions aligned with markdown source (16 chapters + Appendix E).
  • Diagram PNG assets in assets/diagrams/ (26 static Mermaid exports).

Changed

  • Version bump from v0.1.2 (public beta) to v1.0.0 — content scope frozen for citation.
  • README, TOC, and site banner aligned to v1.0.0.

[0.1.2] — 2026-07-05

Added

  • GitHub Pages documentation site: https://mhaghighian.github.io/MLSecOps/ (MkDocs Material, Mermaid).
  • Public-beta README restructure: Getting Started, Downloads, Community feedback, Releases docs.
  • GETTING-STARTED.md, RELEASING.md, releases/README.md.
  • Chapter 16 Kubernetes deployment reference.
  • Appendix E: Implementation Reference — architecture cards, decision matrix, threat model template, Evidence Pack template, playbooks, master control matrix.
  • How to use this guide (Ch.1) and role-based Quick Start (README, docs site).
  • Managed AI services security reference (Ch.2) and Appendix D checklist with Evidence Pack fields.
  • Agent chapter priority 2: think–act cycle, conversation manipulation, exfiltration model, defense layers, secure lifecycle, KPIs.
  • LLM verification approach (Ch.7) complementing OWASP LLMSVS.
  • Positioning: MLSecOps Practical Reference Guide; What this guide adds in Ch.1 and Final Conclusion (four operational contributions).
  • GitHub Actions workflows: pages.yml, manual release.yml (v1.0+).

Changed

  • README: live documentation site link; contributor and governance docs updated.
  • MkDocs site built in CI from chapters-en/ (removed committed docs/ tree).
  • Chapter 3 condensed: demonstrated threats first; emerging topics in summary table (~450 → ~170 lines).
  • Ch.12 tool commands relabeled as optional appendix; Ch.12 reading note: primary mapping vs optional CLI appendix.
  • Removed examples/ directory; Ch.16 points to upstream vendor references only.
  • README, TOC, and citation text aligned with Practical Reference Guide positioning.

Fixed

  • Unified lifecycle terminology across Ch.1, 6, 9, 11, 15, 16 (control points, release decisions, Integrity and Provenance).
  • Appendix order in Ch.15 (A → B → D).

[0.1.1] — 2026-06-21

Fixed

  • Canonical policy gate model (stages 4, 7, 8) vs integrity checkpoint (stage 9); resolved minimum-baseline contradictions.
  • OWASP LLM04 vs LLM08 mapping for retrieval/RAG corpus poisoning (Appendix A, Claims table).
  • MITRE ATLAS AI worm mapping (no false 1:1 ID with memory poisoning).
  • Softened non-standard overclaims in conclusion; clarified OpenSSF relationship (independent, non-affiliated guide).
  • Case study citations and Documented incident vs Illustrative pattern labels.
  • Removed unverified tool reference (BlackVault); privacy/GDPR section for prompt logging; Feature Store, LoRA/PEFT, MCP sections.
  • Maturity Level 3 criteria (process-based, not “zero incidents”); ethics box in Chapter 3.

Added

  • examples/evidence-pack-schema.json — starter Evidence Pack schema.
  • GOVERNANCE.md, CHANGELOG.md.

[0.1.0] — 2026-06

Initial public draft: 15 chapters, MkDocs site, threat/control mapping, maturity roadmap.