Secure model fine-tuning and training data governance
Secure fine-tuning means controlling what goes into a model, who can change it, and what has to be true before it ships. We review the training pipeline end to end: data rights, personal information, poisoning, model files and access to the weights.
Does fine-tuning on customer data create a privacy risk?
Yes, if personal information is in the training set. A model can reproduce fragments of what it was trained on, so the weights should be treated as holding the same class of data as the dataset, and minimization before training is the cheapest control.
Train on support tickets and the model may complete a customer’s account number from half a ticket. The failure modes are set out in fine-tuning safely: training data security basics.
Training data provenance, consent and minimization
Every dataset gets a record: source, licence or terms, collection date, and the purpose people were told about. Under PIPEDA and BC PIPA, personal information is tied to the purposes it was collected for, and training a model is often not one of them. BC public bodies answer to FIPPA instead. We are not lawyers; where the answer turns on the law, we work alongside your counsel, and a privacy impact assessment is often the right vehicle.
Then minimize: drop fields the task does not need, replace direct identifiers, and check free text, where names and phone numbers hide.
Data poisoning defences
Anyone who can write to the training set can shape the model. That includes a shared bucket, a labelling vendor, and a feedback button that feeds ratings back into training. The controls: narrow write access, dataset versions hashed and frozen per run, sampled review of untrusted sources, and trigger tests kept out of the training data. OWASP LLM04, Data and Model Poisoning (2025 list) frames the category.
Model files and access to weights
Several common model formats are Python pickle underneath and run code when loaded. We check which formats you use and whether files are scanned before anything loads them. We also look at who can download the weights, where copies end up (notebooks, laptops, a vendor’s bucket), and whether access is logged. Model sourcing is covered in AI supply chain and model integrity.
Is the safetensors format enough to make model files safe?
It removes the code-on-load problem that pickle-based formats carry, which is the most direct risk in loading a model file. It does nothing about what the weights learned, so provenance and evaluation still apply.
An evaluation gate before release
A fine-tuned model ships only after it passes tests written before training: task quality, memorization probes built from real records, safety behaviour compared with the base model, and the trigger tests. A failure blocks the release. Once it is live, AI security monitoring watches for behaviour drift.
What you receive
- A dataset register with source, terms, purpose and personal information status for each training set.
- Pipeline findings on write access, versioning, model file handling and weight access, ranked by risk.
- An evaluation gate specification your pipeline can enforce.
How the work is bounded
The scope is agreed in writing before work starts, and the engagement is quoted in writing with it.
SecHB does not issue certifications, attestations or audit opinions: those come from accredited certification bodies, CPA firms and QSAs. The work here is what an organization does to be ready for them.
Nothing here is legal advice. Where a question turns on the law, the work is done alongside the client’s counsel, not instead of them.
Questions we are asked
Does this apply to unsupervised or self-supervised training too?
Yes, and the data problem is larger there, because unlabelled corpora are bigger and less reviewed. The same controls apply: provenance per source, personal information filtering, write control on the corpus and an evaluation gate before use.
Do you run the training for us?
No. We review the pipeline, specify the controls and the evaluation gate, and help your engineers wire them in. Your own staff or your platform provider runs the training.
Before the first training run
Tell us what the model is for, what data you plan to train it on, and where training runs. The reply says what a review would cover. Related services are listed under AI security.