Kinetic Gain · AI Security
Pillar guide

AI/ML supply chain security: trust the model you did not train

By Kinetic Gain, AI Security Last updated

The center of a modern AI system is a pretrained model you did not train, delivered as weights you downloaded, shaped by data you never saw, and run through a stack of ML libraries you did not build. This page covers the origin and integrity of the model itself, its weights, its training data, and its dependencies. For attacks on a deployed model at input and query time, see the prompt injection and RAG security guides.

An AI system depends on a pretrained model, its weights, its training data, and a stack of ML libraries, most of which you did not build. Supply chain security establishes provenance and integrity for each before it reaches production. Downloaded model weights + data + deps Untrusted until verified opaque binary, unknown origin Provenance + integrity established pinned hash, signature, AI-BOM, safe format
Treat a downloaded model like untrusted third-party code until its provenance and integrity are established: a pinned hash, a verified signature, a bill of materials, and a serialization format that cannot execute on load.

What AI/ML supply chain security is

For most of software history, the code running in production was code your team wrote or could read. AI systems break that assumption. The center of the system is a pretrained model you did not train, delivered as a set of weights you downloaded, shaped by training data you never saw, and executed through a stack of ML libraries you did not build. AI/ML supply chain security is the practice of establishing where each of those artifacts came from, and whether it can be trusted, before it reaches production.

The trust boundary expands because trust now extends to every upstream party in that chain: the group that trained the base model, the hub that hosts the weights, the maintainers of the serialization format, and every package in the training and serving stack. This is a distinct problem from runtime attacks on a deployed model. This guide covers the origin and integrity of the model itself, its weights, its training data, and its dependencies.

Why it is hard

You cannot read a weight file the way you read source

Traditional supply chain security leans on the fact that you can read source. You can diff a dependency, review a pull request, and reason about what code does. Model weights offer none of that. They are large, opaque binary tensors, and a backdoor planted in them does not look different from ordinary learned parameters. You cannot inspect a weight file the way you read a function, and behavioral testing only samples the input space you thought to test.

Provenance is usually thin. A pretrained model often arrives with little verifiable record of what data it was trained on, what was filtered, or who touched it along the way. Training data provenance in particular is frequently unknown even to the people who published the model. On top of that, the ML dependency stack is large and moves fast: model runtimes, tokenizers, data loaders, GPU-linked libraries, and glue frameworks, many on rapid release cycles. A wide, fast-moving dependency surface is exactly the condition that makes typosquatting and compromised releases hard to catch.

The threats

Poisoned or backdoored weights. A model can be trained or fine-tuned so it behaves normally in general but produces attacker-chosen outputs on a specific trigger. Because the behavior hides in the weights, it survives redistribution and is not visible in a file listing.

Malicious model files. Some model serialization formats can execute arbitrary code at load time. Formats built on Python's pickle deserialize into live objects, which means loading a crafted checkpoint can run code on the machine that loads it. Storage formats that carry only tensor data, such as safetensors, remove that execution path and are the recommended default.

Typosquatted or compromised packages. The ML tooling stack is installed from public registries, so a misspelled package name or a hijacked maintainer account can inject code straight into a training or serving environment. This is the same class of dependency attack seen across software ecosystems, with a larger and faster-changing surface.

Tainted fine-tuning datasets. If you fine-tune on data pulled from an uncontrolled source, an attacker who can influence that source can shape model behavior before it ever serves a request. This is a training-time provenance problem, distinct from the query-time retrieval poisoning the RAG security guide covers.

Establishing provenance and integrity

Signing, an AI/ML bill of materials, and model cards

The answer to an untrusted artifact is a verifiable record of where it came from and proof it has not changed. Three artifacts do most of the work. First, cryptographic signing and verification of model files, so a downloaded checkpoint can be matched to a known publisher and a known hash rather than trusted on faith. The signing and transparency patterns established for software artifacts, such as sigstore and the SLSA provenance framework, map directly onto model and dataset artifacts, and NIST's supply chain guidance frames the same integrity expectations. Second, an AI/ML bill of materials: a machine-readable record of which model, which version, which training or fine-tuning data, and which dependencies went into a deployed system, extending the SBOM idea into the ML stack. Third, model cards, which document a model's intended use, training data, and known limitations, giving lineage a human-readable home.

Signing only means something if someone verifies the signature, and verification needs a published, checkable attestation on the other end. That signed-provenance layer is the domain of the Kinetic Gain Protocol, an open specification for publishing and verifying signed provenance and evidence attestations. Treat it as one honest option for making provenance checkable across parties, not a substitute for the controls below.

DimensionTraditional software supply chainAI/ML supply chain
Primary artifactSource code and compiled packagesPretrained model weights, training data, and ML libraries
How you inspect itRead and diff human-readable sourceWeights are opaque binary tensors you cannot read directly
Provenance signalVersion control history, signed releases, SBOMModel cards, signed model artifacts, an emerging AI/ML BOM
Main novel riskVulnerable or malicious dependency codeBackdoored weights and model files that execute code on load
Maturity of toolingMature, with scanners, SCA, and signing widely adoptedEarly, with signing, scanning, and BOM practices still emerging

Practical controls

Treat a downloaded model like untrusted third-party code, because on some formats it literally is.

Harden your AI/ML supply chain

  1. Inventory every model and its origin. Build an AI/ML BOM that records every deployed model, its version, its source, its training or fine-tuning data, and its dependencies.
  2. Pin and verify hashes and signatures on download. Record a cryptographic hash for each model artifact and verify it, along with the publisher signature where available, on every download.
  3. Use safe serialization and scan before loading. Default to formats that store only tensors, and scan any pickle-based model file in isolation before loading it.
  4. Lock and monitor the ML dependency tree. Pin the full dependency graph with a lockfile and continuously monitor it for known vulnerabilities.
Illustrative scenarioA team pulls a popular pretrained model from a public hub and loads it straight into a training job without recording or verifying its hash. A tampered copy, substituted upstream, loads without complaint because nothing was checking that the bytes matched a known-good artifact. The first signal of a problem is behavior in production, long after the download.
Illustrative scenarioAn engineer adds a dependency to a training pipeline and mistypes the package name by one character. A typosquatted package under that name installs and runs its setup code inside the pipeline environment, which holds data access and credentials. Nothing looks wrong in the logs, because the pipeline built and ran normally.

What to measure

Three signals tell you whether the program is real, not aspirational.

Verified provenance coverage

Share of deployed models with verified provenance and a pinned hash. The headline coverage number.

Target: climbing toward full coverage

Dependency exposure

Freshness and known-vulnerability exposure across the ML dependency stack, so a fast-moving surface does not quietly accumulate risk.

Target: low and monitored, not unknown

AI/ML BOM coverage

Fraction of deployed models for which you can produce a complete bill of materials: model, version, data lineage, dependencies.

Target: a complete BOM per deployed model

Safe-format adoption

Share of model artifacts stored in formats that cannot execute code on load, versus pickle-based checkpoints that can.

Target: safe formats by default

FAQ

Can a machine learning model contain malware?
Yes. Some model file formats can execute arbitrary code when the file is loaded, because they deserialize into live objects rather than plain data, so opening a crafted checkpoint can run code on your machine. Separately, the weights themselves can be backdoored to trigger attacker-chosen behavior on a specific input. Treat model files as untrusted third-party code: verify their source, prefer formats that cannot execute on load, and load unfamiliar files in isolation.
How is AI supply chain security different from normal software supply chain security?
The core artifact is different. In normal software you can read and diff source, but a model is opaque binary weights you cannot inspect the same way, and its provenance and training data are often unknown even to the publisher. The threats extend beyond vulnerable dependency code to backdoored weights and model files that execute on load, and the tooling for signing, scanning, and inventorying these artifacts is still early compared to its mature software equivalents.
What is an AI bill of materials (AI-BOM)?
An AI-BOM, also called an ML-BOM, is a machine-readable inventory of everything that went into an AI system: which model and version, the training or fine-tuning data, and the software dependencies. It extends the software bill of materials (SBOM) concept into the ML stack. It is the record that lets you answer, for any deployed model, exactly where each part came from.
How do I verify a downloaded model is what it claims to be?
Pin a known cryptographic hash of the artifact and recompute it after download, so any substitution fails the check. Prefer publishers who sign their artifacts and verify that signature, and prefer safe serialization formats that cannot execute code on load. Until those checks pass, treat the file as untrusted code.