Supply-Chain Attacks

MITRE ATLAS: T0002.001 — Acquire Public ML Artifacts; T0006.001 — ML Artifact Persistence
OWASP LLM Top 10: LLM05 — Supply Chain Vulnerabilities
NIST AI 600-1: §2.12 (Value Chain/Component Integration)
EU AI Act: Art. 25 (Provider obligations), Art. 28 (Deployer obligations)
SLSA: Supply-chain Levels for Software Artifacts v1.0

Attack Surface

Component	Threat	Real-World Example
Training data	Poisoned public corpora (LAION, Common Crawl, The Pile)	Malicious uploads to Common Crawl
Pre-trained models	Backdoored weights on Hugging Face / PyTorch Hub	`malicious-model.safetensors` with trigger
Fine-tuning adapters (LoRA, PEFT)	Compromised adapter weights	Poisoned LoRA injected at inference
Dependencies	Malicious PyPI / npm packages in training/inference code	`torchvision` typo-squat, `transformers` supply-chain
CI/CD pipelines	Compromised build → poisoned artefact	SolarWinds-style for ML
Inference infrastructure	Compromised container images, model servers	Malicious Triton / vLLM image

Primary source: MITRE ATLAS T0002.001, T0006.001. ATLAS

SLSA for ML Artefacts

SLSA Level	Requirements (adapted for ML)
Level 1	Build scripted; provenance generated (hashes, build command)
Level 2	Hosted build service; tamper-resistant provenance; signed artefacts
Level 3	Hardened build platform; non-falsifiable provenance; hermetic builds
Level 4	Two-party review; reproducible builds; end-to-end signing

ML-specific additions:

Model cards signed with provenance (training data hash, compute, hyperparameters)
Dataset SBOM — list all sources, hashes, licences
Adapter/LoRA weights signed by author; verify before load

ML-BOM (Machine Learning Bill of Materials)

Field	Description
Model	Name, version, architecture, framework, hash (SHA256 of weights)
Training Data	Dataset names, versions, hashes, sources, licences
Compute	GPU type, hours, cloud provider, region
Dependencies	Framework version, CUDA/cuDNN, Python packages (`pip freeze`)
Provenance	Build URL, commit SHA, builder identity, timestamp
Signatures	Author sig, build service sig, notarisation log entry

Primary source: SLSA Framework v1.0. slsa.dev

Verification Gates

Gate	Check	Tooling
Pre-training	Dataset hash matches approved manifest	`sha256sum`, `cosign verify-blob`
Build	SLSA provenance generated & verified	`slsa-verifier`, `cosign verify-attestation`
Registry	Model card + SBOM published; signatures verified	`oras`, `cosign`, `syft`
Deployment	Admission controller verifies SBOM + sigs before pod start	`kyverno`, `gatekeeper`, `ratify`
Runtime	Periodic re-verification of loaded weights (hash check)	Custom sidecar, `cosign`

Mitigations

Layer	Control	Standard Mapping
Data	Signed dataset manifests (SLSA, in-toto)	NIST AI 600-1 GOVERN-4, ISO 42001 A.3.3
Data	Dedup + anomaly detection on raw corpora	OWASP LLM05, NIST AI RMF MAP-2.3
Build	Hermetic, reproducible builds (Bazel, Nix)	SLSA Level 3+, NIST AI 600-1 MANAGE-2.2
Registry	Notarised model cards + SBOM (cosign, rekor)	NIST AI 600-1 MANAGE-2.1, SLSA
Supply Chain	SBOM for datasets — track source, hash, licence	NIST AI 600-1 GOVERN-4, ISO 42001 A.8.1
Governance	Approved model registry; block unvetted sources	EU AI Act Art. 25, ISO 42001 A.5.1

Citation Register

Claim	Instrument	Provision	URL
Public ML artifact acquisition	MITRE ATLAS	T0002.001	https://atlas.mitre.org/techniques/T0002.001
ML artifact persistence	MITRE ATLAS	T0006.001	https://atlas.mitre.org/techniques/T0006.001
Supply chain taxonomy	OWASP LLM Top 10	LLM05	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Value chain risk	NIST AI 600-1	§2.12	https://doi.org/10.6028/NIST.AI.600-1
Provider obligations	EU AI Act	Art. 25	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Deployer obligations	EU AI Act	Art. 28	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
SLSA for ML	SLSA Framework	v1.0	https://slsa.dev/