What it means
Model supply-chain security verifies the origin, integrity, dependencies, licenses, safety, and allowed use of models and supporting artifacts obtained or moved across organizational boundaries.
Why it matters
Pretrained models, datasets, libraries, containers, and hosted services can carry hidden behavior, vulnerabilities, malicious code, or unsuitable terms.
Practical focus
- Define the scope, owners, acceptable risk, and required outcome for model supply-chain security before choosing a tool or platform feature
- Implement approved sources, artifact signing, malware and dependency scanning, sandbox evaluation, provenance records, and contractual controls through documented, reviewable configuration and change control
- Collect source attestations, hashes, bills of materials, scan findings, licenses, evaluation results, and promotion approvals and compare the results with approved baselines, service objectives, and policy requirements
- Exercise an external model or serialization format executing code, hiding unsafe behavior, or changing after approval as a planned test case, including detection, containment, rollback, escalation, and evidence retention
Common mistakes
- Treating model supply-chain security as a one-time technical setting instead of an operating control with owners and review cycles
- Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
- Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
- Testing only the normal path and discovering during an incident that an external model or serialization format executing code, hiding unsafe behavior, or changing after approval was never rehearsed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: