ML Supply Chain Security
Untrusted weights and datasets, deserialisation risk, dependency and registry attacks, and signing artefacts.
11concepts
99flashcards
81minutes of reading
- 01 Dependency and Registry Attacks in ML Stacks Why ML environments are unusually exposed to package-level attacks, the specific techniques that keep working, and the controls that actually reduce exposure.
- 02 Hallucinated Dependencies and Slopsquatting Why a code-generating model invents package names that do not exist, why it invents the same ones repeatedly, and how that repeatability turns a model error into a pre-registerable attack surface that lockfiles and signatures cannot see.
- 03 Prompt Artefacts as Executable Dependencies Why rules files, skills, agent instructions and system prompts shipped in a repository are code by any operational definition, how invisible Unicode makes them reviewable in theory and not in practice, and what intake for a text dependency has to check.
- 04 Untrusted Weights and Deserialisation Risk Why loading a model file can execute code, what safetensors changed, and the checks that belong in any pipeline that downloads weights from a public hub.
- 05 Vetting Third-Party Models and Datasets A practical intake process for an artefact you did not produce, what each check can and cannot establish, and how to size the effort to the deployment's exposure.
- 06 Coding Agents as a Supply Chain Target Why an installed coding agent is a credential-discovery engine an attacker can borrow, what the Nx s1ngularity compromise demonstrated about that, and how agent autonomy turns a per-machine compromise into a self-propagating one.
- 07 Containing Install and Build Time Execution Why arbitrary code runs before any of your tests do, what disabling lifecycle scripts and constraining egress actually buys, and how to keep dependency resolution and dependency execution as separate, separately-governed events.
- 08 MCP Server Trust and Tool Poisoning Why a tool description is executable content inside the model's trust boundary, how shadowing and rug-pull attacks exploit the absence of any integrity check on that description, and what intake and pinning look like for a dependency whose interface is prose.
- 09 Securing Model Serving Infrastructure Why an inference server is an internet-facing distributed system with a large native attack surface, what recent CVEs in Triton, vLLM and Ray teach about where it breaks, and what GPU isolation and confidential computing do and do not protect.
- 10 Securing the Training Pipeline Why the training environment is a high-value target with unusually broad access, the specific credential and isolation failures that recur, and the controls proportionate to what a compromise would yield.
- 11 Signing, Attestation and SBOMs for Models How software supply chain frameworks map onto model artefacts, what a model bill of materials should contain, and why the interesting claims are about the training process rather than the file.