Google treats AI security as ordinary security extended to a new kind of system, plus a handful of risks that only exist because there is a model in the path. The exam asks about the framework and the tools rather than about attack technique.
Security across the lifecycle
Each stage carries its own exposure, and the point of the framing is that securing one is not securing the system.
Data collection and preparation. Usually the largest concentration of sensitive material in the whole project, and frequently the least protected, sitting in storage somebody opened during development. Poisoning also begins here, where altered training data teaches the model something planted.
Training. Who could change the data, the code or the parameters, and whether anyone would notice.
Deployment. The endpoint is a resource like any other. Who may call it, who may change it, and whether it is rate limited, which is partly what stops a model being rebuilt by querying it repeatedly.
Use. Prompt injection, sensitive information coming back out of context, and whatever the system is permitted to act on.
Monitoring. Whether you would know. Logging what was asked and answered makes an incident reconstructable, and immediately creates its own privacy question, because the log now holds whatever users typed.
The Secure AI Framework
SAIF is Google's published framework for securing AI systems. Its purpose is to give organisations a common structure for thinking about AI risk, so that security teams already competent at protecting software have a way to extend that competence rather than starting over.
Its themes are worth knowing in outline. Extend existing security foundations to AI rather than building a parallel programme. Widen detection and response to include AI systems. Automate defences to keep pace. Harmonise controls across the organisation so every team is not inventing its own. Adapt controls as the threats change. And put AI system risks into the surrounding business risk process rather than treating them as a separate technical concern.
The benefit the exam is looking for is consistency. Without a framework, every team makes its own judgement about what is safe enough, and the organisation has no way to compare or govern those judgements.
SAIF is a framework rather than a certification. ISO/IEC 42001 is the standard an organisation is certified against, and the two are easy to confuse.
The tools
Secure by design infrastructure is Google's claim that the underlying platform carries protections by default rather than as configuration, covering encryption at rest and in transit, hardware roots of trust and network isolation.
Identity and Access Management is the primary control and the one that decides most outcomes. Who may call a model, read the training data, change a deployment or use a tool an agent has. Least privilege applies here exactly as it does anywhere else, and it matters more once an agent can act.
Security Command Center is the security posture and threat view across a Google Cloud environment. Misconfigurations, vulnerabilities and active threats in one place, which is how an AI workload gets watched alongside everything else rather than separately.
Workload monitoring covers the operational picture, what is running, what it is calling and whether behaviour has changed.
The reading for a product person
Two questions are worth carrying into any AI project. What is this system permitted to do if somebody manipulates its input, and would we know afterwards. Almost every control in this section is an answer to one of those.