Supply Chain Attacks

AI supply chain attacks target the components that produce and distribute models before they reach production. A model deployed to serve millions of users passed through a training pipeline, a dataset curation process, a fine-tuning step, a model registry, and a dependency installation — each of which is a potential injection point for a backdoor or malicious payload that the serving infrastructure will never detect.

Supply chain attacks are high-leverage because they compound: a single poisoned public dataset affects every organization that trains on it, a malicious model on Hugging Face executes on every machine that loads it, and a dependency confusion package fires in every CI/CD pipeline that installs the affected requirements file. The attack happens before deployment, making runtime defenses irrelevant.

Pages in This Section

Dataset Poisoning to Influence Model Behavior at Training Time covers injecting backdoor samples into public datasets, crowdsourced annotation pipelines, and web-scraped training corpora to embed trigger-activated behavior in models trained on poisoned data.

Malicious Model Weight Injection via Public Registries covers crafting pickle-based PyTorch model files that execute arbitrary code on load, wrapping them in convincing repository structures on Hugging Face, and targeting organizations that load models without safetensors enforcement.

LoRA and Adapter Backdoors covers embedding execution payloads in LoRA adapter files through pickle deserialization, training adapters with behavioral backdoors encoded directly in the weight values, and distributing them through public registries targeting specific base models.

Dependency Confusion Attacks Against AI Python Packages covers discovering internal package names from public artifacts, publishing higher-versioned packages to PyPI with the same names, and executing payloads during pip install in target CI/CD pipelines and developer environments.

Compromising Model Fine-Tuning Pipelines covers targeting training infrastructure on cloud storage, backdooring preprocessing scripts to inject poisoned samples into the training dataset, modifying training configurations to amplify memorization, and intercepting model exports to inject execution payloads into production checkpoints.