Zero-Trust Data Pipelines for AI Systems: A Framework for Secure, Verifiable, and Auditable Data Engineering

Abstract

Training data is the primary attack surface that most AI security strategies leave unguarded. Pipelines built on perimeter trust treat every connected component as reliable after initial authentication, a design that worked tolerably in closed, homogeneous environments but fails badly in the distributed multi-vendor architectures where modern AI systems operate. An adversary with access to a pipeline ingestion layer, whether through credential theft, supply chain compromise, or insider privilege, can silently corrupt training data at a scale that no downstream evaluation benchmark is designed to detect. This paper introduces the Zero-Trust Data Pipeline (ZTDP) framework which applies the never-trust-always-verify principle to data artifacts directly rather than to the network channels that carry them. The framework is organized across five coordinated security planes: a Data Plane that enforces cryptographic authentication on every artifact, a Control Plane that maintains continuous identity verification a Provenance Plane that builds a tamper-evident lineage graph through ECDSA-P384-signed JWT tokens, a Policy Plane that enforces least-privilege access through co-located Open Policy Agent instances, and an Observability Plane that combines statistical distribution monitoring Isolation Forest scoring and Hidden Markov Model sequence analysis for real-time anomaly detection. Evaluated against a 500-million-record financial AI training workload, the full ZTDP configuration achieves 100% detection of data tampering insider injection and component impersonation, and 96% detection of behavioral anomalies, while adding 9.1% throughput overhead and 0.8 ms per-stage latency. The results establish that rigorous data-layer security and production-grade throughput are not in fundamental tension.