AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 2 / c2.7
Enhanced Logging and MonitoringDefense-in-depth layer: AI Application Capability 2 · Model customizationUse case: AI you build 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c2.7 Detect training-data leakage with canaries

Seed unique canary strings into training data and alert if they ever appear in model output, revealing that the model is memorizing and reproducing training data.

Foundational
Enhanced
Advanced
Effort: Medium Impact: Medium GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 4 · Fine-tuned models; 5 · Self-trained models

Implementation guidance

How to implement on AWS

Introduce unique, identifiable canary strings into training data that should never appear in outputs. Enable prompt/response logging and configure CloudWatch alerts to fire when a canary is detected in model output.

Acceptance criteria

Canaries are embedded in training data; output logging is enabled; an alert fires if a canary appears in a response.

Practical implementation

How this control is implemented in each reference architecture:

Unique canary strings are seeded into training data; invocation logging in the Generative AI account and a CloudWatch alarm detect if a canary ever surfaces in output.

  1. Seed unique, identifiable canary strings into the training data that should never legitimately appear in model output.
    Generative AI account Amazon S3
  2. Enable Bedrock model-invocation (prompt/response) logging and scan outputs for the canary values.
    Generative AI account Amazon Bedrock CloudTrail CloudWatch
  3. Configure a CloudWatch alarm (and Security Hub finding) that fires the moment a canary appears in a response, and forward logs to the Log archive.
    Generative AI account → Log archive CloudWatch Security Hub

How to validate: Canaries are present in training data; response logging is on; a synthetic test that elicits a canary triggers the alarm.

Avoid: Assuming the model will not memorize training data. Plant canaries so leakage is detectable rather than hoped-against.

Generative AI OU (multi-account) →

Canary strings in training data plus in-account response logging and a CloudWatch alarm reveal memorization/leakage.

  1. Embed unique canary strings in the training data.
    Generative AI tier (IAM role) Amazon S3
  2. Turn on model-invocation logging and scan responses for the canaries.
    In-account logging Amazon Bedrock CloudTrail CloudWatch
  3. Alarm in CloudWatch when a canary appears in output.
    In-account logging CloudWatch

How to validate: Canaries are embedded; output logging is enabled; a canary in a response raises an alarm.

Avoid: Having no way to tell if the model regurgitates training data. Canaries turn an invisible risk into a monitored one.

Single account (entry point) →

Threats addressed

  • Model inappropriately memorizing and reproducing training data.
  • Undetected leakage of proprietary or sensitive training content.

AWS services

Amazon CloudWatch AWS CloudTrail

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM02 Sensitive Information Disclosure
  • LLM05 Data and Model Poisoning

NIST AI Risk Management Framework (AI 100-1)

  • MEASURE.3 Mechanisms for tracking AI risks are in place
  • MANAGE.4 Risk treatments, monitoring and response are documented and applied

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC03-BP01 Implement control plane and data access monitoring

Learning resources

References

  • AWS SRA for AI — Capability 2, Rationale