SIEM ALERT [CRITICAL] 03:14:07 UTC: MLflow artifact integrity check failed on model version `credit-scorer-v4.2` (RunID: `8f3c1a9d`). SHA-256 mismatch: expected `a3f7c2...d91b` vs stored `7e04ab...fc33`. Simultaneously, artifact server logs show an outbound pip install from the model's `requirements.txt` resolving `scikit-learn==1.2.2` to PyPI index `pypi-mirror.mlops-tools[.]xyz` (non-whitelisted). CI/CD pipeline user `svc-mlpipeline@corp.internal` performed the last registry write at 02:58:41 UTC, 4 minutes before the scheduled pipeline window (03:02 UTC). 3 of 5 inference API pods restarted in the past 12 minutes (exit code 137: OOMKilled).

3:14 AM: Suspicious MLflow Model Artifact Integrity Failure + Unexpected Dependency Pull

You are an on-call ML security analyst for a financial services firm running an MLflow Model Registry backed by S3, used to serve credit-risk scoring models via a FastAPI inference API. Models are promoted through dev -> staging -> production stages by automated CI/CD pipelines. A downstream RAG chatbot also loads embeddings models directly from this registry at startup.

SIEM Rule "ML-SUPPLY-007: PyPI Dependency Hash Mismatch on Model Artifact Ingest" fired at 03:12:17 UTC. MLflow artifact store (S3: s3://prod-mlflow-artifacts/fraud-detection/) logged a model registration event for model version v4.17 where the SHA-256 hash of the bundled requirements.txt resolved package `scikit-learn==1.4.1` (hash: sha256:a93b3f2e...d441) does not match the pinned hash in the internal golden manifest (expected: sha256:7c91d0aa...b883). Additionally, the model was registered by service account `ci-runner-07`, an account that has not registered a model in the past 93 days. Registry event log: `POST /api/2.0/mlflow/model-versions/create | user=ci-runner-07 | src_ip=185.220.101.47 | latency=312ms`. Source IP 185.220.101.47 resolves to a Tor exit node.

3:12 AM: Suspicious Package Integrity Failure on MLflow Model Registry Ingest

The affected system is a production MLflow tracking server (v2.11.1) running on Kubernetes, used by a financial services ML platform to register, version, and serve gradient-boosting fraud detection models. You are the on-call MLSecOps analyst. Models promoted from this registry are automatically deployed to a real-time inference API serving ~40,000 transaction scoring requests per hour.

SIEM ALERT [CRITICAL], 03:12:07 UTC | Source: Dependency Audit Bot (Renovate + pip-audit integration)
Rule: "Known-malicious package hash detected in pipeline virtual environment"
Detail: Package `mlflow-skinny==2.9.2` resolved during CI job #4471 (branch: main, commit: a3f9d1c) has SHA256 hash `e7c3a1...f902bb` which does NOT match PyPI canonical hash `d1a8f3...3301cc`. Artifact `credit_risk_v4.pkl` was successfully registered to MLflow Model Registry at 03:09:44 UTC and auto-promoted to STAGING. pip-audit output: "PYSEC-2024-SHADOW-112: mlflow-skinny 2.9.2, typosquat variant with exfiltration payload targeting MLFLOW_TRACKING_URI and AWS_SECRET_ACCESS_KEY env vars." 2 subsequent pipeline jobs (#4472, #4473) are currently queued.

3:12 AM: Poisoned Dependency Detected in MLflow Model Registry Publish Pipeline

You are an on-call ML Security Engineer at a fintech company running a production MLflow tracking server (v2.9.1) that serves as the artifact registry for a credit-risk scoring inference API. Registered models are automatically promoted to staging via a CI/CD pipeline triggered on push to the main branch. Your role is to contain blast radius, determine if any poisoned artifacts reached production, and preserve forensic evidence.