ML Supply Chain Security
Untrusted weights and datasets, deserialisation risk, dependency and registry attacks, and signing artefacts.
11concepts
99flashcards
81minutes of reading
- 01 Dependency and Registry Attacks in ML Stacks Why ML environments are unusually exposed to package-level attacks, the specific techniques that keep working, and the controls that actually reduce exposure.
- 02 Hallucinated Dependencies and Slopsquatting Why a code-generating model invents package names that do not exist, why it invents the same ones repeatedly, and how that repeatability turns a model error into a pre-registerable attack surface that lockfiles and signatures cannot see.
- 03 Prompt Artefacts as Executable Dependencies Why rules files, skills, agent instructions and system prompts shipped in a repository are code by any operational definition, how invisible Unicode makes them reviewable in theory and not in practice, and what intake for a text dependency has to check.
- 04 Untrusted Weights and Deserialisation Risk Why loading a model file can execute code, what safetensors changed, and the checks that belong in any pipeline that downloads weights from a public hub.
- 05 Vetting Third-Party Models and Datasets A practical intake process for an artefact you did not produce, what each check can and cannot establish, and how to size the effort to the deployment's exposure.