L15. AI Supply Chain Security: Models, SBOMs & Dependencies

The AI Supply Chain

Every AI system in production rests on a supply chain of components it did not build:

• Pre-trained base models: downloaded from Hugging Face, a cloud provider registry, or a vendor
• Third-party training datasets: licensed data, web-scraped data, open-source datasets
• ML frameworks: PyTorch, TensorFlow, JAX, Hugging Face Transformers, LangChain, LlamaIndex
• Model serving infrastructure: vLLM, Triton, ONNX Runtime, vendor-managed serving
• MCP servers and plugins: third-party integrations connecting the model to the world

Any of these can be compromised or malicious, and the consequences propagate forward to every system built on top.

Model Provenance and Integrity

When you download a pre-trained model, how do you know it is what it claims to be? Risks:

• Typosquatting: a model named "llama-3-8b" that is actually a backdoored variant
• Compromised uploads: a legitimate model publisher whose account is compromised to distribute a malicious version
• Dependency confusion: a private model name that an attacker registers publicly with a higher version number

Controls:

• Verify model checksums (SHA-256) against publisher-provided hashes before loading
• Use signed model artifacts where available (emerging capability in Hugging Face and cloud registries)
• Pin model versions explicitly; do not use "latest" tags in production
• Maintain an internal model registry: download approved models once, verify, and serve from the internal registry
• Scan model files with tools like ModelScan that detect serialization attacks in PyTorch pickle files

AI SBOM (Software Bill of Materials)

An AI SBOM extends traditional software SBOM to cover AI-specific components. A complete AI SBOM includes:

The AI SBOM enables: vulnerability tracking (CVEs in ML libraries), incident response (which systems use the affected model), and compliance documentation (training data provenance for GDPR and EU AI Act).

Securing the Model Registry

The internal model registry is a high-value target: compromising it allows distributing malicious models to all systems that pull from it.

Controls:

• Require code review and security scan before merging new models into the registry
• Sign registry entries; clients verify signatures before loading
• Immutable artifact storage: once a model version is published, it cannot be overwritten
• Access control: separate read (for inference services) from write (for model deployment pipeline)
• Alert on unexpected new model versions or permission changes