How to Isolate Tenants in Generative AI Cloud Applications

Summary

The article applies the PEACH tenant-isolation framework to GenAI cloud apps, explaining cross-tenant risks and how interface complexity, data access, customization and architecture choices should shape isolation.

Key points

• GenAI applications may expose cross-tenant data or model-integrity risks if prompts, histories, indexes or customized models are not properly isolated.
• The article discusses data poisoning, direct and indirect prompt injection, and hallucination abuse as potential attack vectors.
• Inference-interface risk depends on how prompts are processed and what other components the model can access; broad access or code execution calls for stronger isolation.
• Dedicate indexes when they contain tenant data or tenants can influence their contents; keep user-finetuned models per tenant. Immutable foundation and consumer base models can generally be shared.
• Shared databases should use row-level security, and shared models should not have facilitated access to data belonging to multiple tenants.
• Single-tenant designs can strengthen isolation but are less efficient, harder to maintain and more expensive; hybrid designs can vary isolation by tenant needs.
• The authors recommend reviewing customer-facing interfaces and security boundaries, treating prompt and response filters as weak boundaries, limiting model access, and carefully sanitizing and anonymizing training data.