AI supply chain security

The security of the components and processes from which AI systems are assembled: training datatraining data, n.: The examples an AI system learns from. Whatever patterns, skills, gaps and biases are in the training data tend to show up in the finished system. and its sources, pretrained models and adapters from public hubs such as Hugging FaceHugging Face, prop. n.: A company whose website is the main public library for sharing AI models and datasets — often called the GitHub of machine learning — and which makes widely used free AI software., machine-learning libraries and their dependencies, serving infrastructure, plugins and agent tool serversMCP server, n.: A small program that makes some service — say a database, a calendar or a company's internal tools — available to any AI assistant that speaks the Model Context Protocol.. Characteristic risks include model files in serialization formats that execute code when loaded (notably Python's pickle), backdooredbackdoor attack, n.: Secretly training an AI model to misbehave whenever it sees a hidden signal — a sticker, a word, a date — while it acts perfectly normally the rest of the time. or tampered weights published under look-alike names, poisoned datasetsdata poisoning, n.: Sneaking bad examples into the data an AI learns from, so the finished model behaves as the attacker wants — badly overall, or wrongly only in special situations., compromised or hallucinated dependencies (slopsquattingslopsquatting, n.: An attack that exploits AI coding assistants' habit of inventing software packages that do not exist: attackers publish malicious code under those made-up names and wait for people or agents to install it.), and malicious tool definitions (tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.). Defenses adapt software supply-chain practice: safe formats such as safetensorssafetensors, n.: A file format for storing an AI model's learned numbers that cannot hide harmful programs and loads very quickly, replacing older formats that could run code when opened., scanning and sandboxed loading of models, cryptographic signing and provenance attestations for models and datasets, AI bills of materials listing a system's components, pinned versions, and data provenancedata provenance, n.: The documented history of a piece of data: where it came from, who created and changed it, under what permissions, and how it was processed before reaching an AI system. records.

Our AI supply chain policy bans pickle files and accepts only signed models from approved publishers.