ML Supply Chain Security
Untrusted weights and datasets, deserialisation risk, dependency and registry attacks, and signing artefacts.
11concepts
99flashcards
81minutes of reading
- 01 Coding Agents as a Supply Chain Target Why an installed coding agent is a credential-discovery engine an attacker can borrow, what the Nx s1ngularity compromise demonstrated about that, and how agent autonomy turns a per-machine compromise into a self-propagating one.
- 02 Containing Install and Build Time Execution Why arbitrary code runs before any of your tests do, what disabling lifecycle scripts and constraining egress actually buys, and how to keep dependency resolution and dependency execution as separate, separately-governed events.
- 03 MCP Server Trust and Tool Poisoning Why a tool description is executable content inside the model's trust boundary, how shadowing and rug-pull attacks exploit the absence of any integrity check on that description, and what intake and pinning look like for a dependency whose interface is prose.
- 04 Securing Model Serving Infrastructure Why an inference server is an internet-facing distributed system with a large native attack surface, what recent CVEs in Triton, vLLM and Ray teach about where it breaks, and what GPU isolation and confidential computing do and do not protect.
- 05 Securing the Training Pipeline Why the training environment is a high-value target with unusually broad access, the specific credential and isolation failures that recur, and the controls proportionate to what a compromise would yield.
- 06 Signing, Attestation and SBOMs for Models How software supply chain frameworks map onto model artefacts, what a model bill of materials should contain, and why the interesting claims are about the training process rather than the file.