Google Cloud unveils AI security blueprint for GKE

Google Cloud has published an AI workload security blueprint for Google Kubernetes Engine, setting out a framework for protecting AI systems running on its managed Kubernetes platform.

The blueprint groups AI security into three layers: infrastructure, model security, and application security. It is aimed at chief information security officers and platform engineering teams moving AI systems from development into production.

At the infrastructure layer, the starting point is a secure cluster configuration. The document highlights Confidential GKE Nodes, including support for confidential GPUs and TPUs, as a way to apply hardware-based memory encryption and attestation to AI workloads that handle sensitive data.

It also points to identity and network controls across the wider cloud platform. Workload Identity Federation for GKE is presented as a way for inference pods to retrieve model weights from Cloud Storage without long-lived keys, while VPC Service Controls can place regulated workloads inside a tighter data perimeter.

Three layers

For model security, the blueprint focuses on the provenance and integrity of model weights and related artefacts. Traditional software bills of materials, it argues, do not fully account for AI components such as models, datasets, and frameworks.

To address that gap, Google Cloud highlights k8s-aibom, which it describes as an AI bill of materials for Kubernetes. The aim is to create an inventory of the assets involved in training and serving models so operators can track what is deployed in production.

The application layer addresses threats that emerge when users interact directly with models. These include prompt injection, exposure of personally identifiable information, and harmful content generation, which the blueprint treats as issues requiring controls in the inference path itself.

Model Armour can sit between an application and an inference endpoint to inspect prompts and responses. The document also highlights the GKE Inference Gateway for session-level observability and quota enforcement, including per-user rate limits and detection of abuse patterns such as session manipulation and excessive inference use.

Another part of the application guidance covers AI agents that run generated code or use external tools. In those cases, the blueprint recommends GKE Sandbox using gVisor as an isolation boundary to reduce the risk of container escape and limit the effect of unpredictable behaviour on the underlying node.

Phased rollout

Beyond the technical controls, Google Cloud sets out a three-phase approach for organisations adopting the framework. The first stage, Deploy, centres on baseline measures such as enabling Workload Identity, putting Model Armour in front of inference endpoints, and running sensitive workloads on Confidential GKE Nodes.

The second stage, Operate, shifts attention to production hardening. The blueprint recommends signed-image policies with Binary Authorization, tuning Model Armour profiles, and aggregating audit logs so security teams can correlate events across different layers of the stack.

The third stage, Govern, is aimed at larger-scale operational oversight. That phase includes organisation-level guardrails through Organisation Policy Service, admission-time policies through Kubernetes webhooks, and automated incident response for detections judged to be high confidence.

The guidance reflects a broader shift in enterprise AI deployment as security teams try to adapt controls built for conventional software to models, datasets, and inference systems. It also underscores how cloud providers are packaging existing infrastructure, identity, and monitoring products into AI-specific operating models for customers building applications on managed platforms.

Google Cloud argues that AI systems need protections at several layers rather than a single defensive control. The blueprint therefore combines infrastructure isolation, identity rules, artefact tracking, content inspection, and policy enforcement into one reference model for teams using GKE.

It also treats observability as a core part of the design, recommending that teams monitor environments over time rather than rely only on deployment-time checks. That emphasis on ongoing monitoring reflects the operational challenges of AI systems, where risks can emerge during inference as well as during software build and deployment.

Model weights are treated as sensitive intellectual property, while prompts and outputs are framed as potential routes for data leakage and misuse. By treating both as security issues, the blueprint broadens Kubernetes security beyond container and cluster management to the behaviour of AI applications running on top of them.

The release adds to a growing body of vendor guidance aimed at customers trying to formalise internal AI controls before wider rollout. In this case, the material is closely tied to Google Cloud services already used for compute, storage, networking, policy, and audit logging in its cloud environment.

The objective, according to the document, is to help organisations build a secure-by-default GKE platform that can support AI deployments at scale.