Master Thesis MSTR-2025-106

BibliographyChugh, Abhishek: A Case Study on Preventing Unauthorized Access to AI Model APIs in MLOps.
University of Stuttgart, Faculty of Computer Science, Electrical Engineering, and Information Technology, Master Thesis No. 106 (2025).
53 pages, english.
Abstract

This thesis examines authentication mechanisms for securing AI model Application Programming Interfaces (APIs) within MLOps environments, focusing on API keys, OAuth 2.0, and JWT approaches. As MLOps pipelines increasingly automate deployment and enable direct Machine-to- Machine (M2M) communication, authentication becomes a critical defense against unauthorized access. Through a systematic literature review and hands-on experiments with the Hugging Face API, this work evaluates the security, performance, and usability trade-offs of each method. The experimental design aligns with common risks described in the OWASP API Security Top 10, testing scenarios such as token leakage, replay attacks, and expired token misuse. Findings show that while API keys are widely used for their simplicity, they are highly vulnerable to compromise. OAuth 2.0 offers more robust security controls, but at the cost of added complexity. JWTs strike a balance, providing stateless verification but remaining prone to certain implementation flaws. The results highlight the importance of short-lived credentials, strict scope enforcement, and continuous monitoring to reduce exposure in MLOps workflows. These insights aim to guide practitioners in selecting and configuring authentication mechanisms for secure, reliable AI model API integrations.

Department(s)University of Stuttgart, Institute of Software Technology, Empirical Software Engineering
Superviser(s)Wagner, Prof. Stefan; Haug, Markus
Entry dateMarch 17, 2026
New Report   New Article   New Monograph   Computer Science