AI glossary · Basic · AI security · AI platforms & solutions
AI supply chain security
AI supply chain security is the practice of checking and protecting the external components that go into building an AI system (datasets, pretrained models, libraries, plugins and so on) to ensure they have not been contaminated or tampered with.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Security & safety
- Added
- 2026-10-09
How it works
Today's AI services are rarely built entirely from scratch. Teams download model weights from public repositories, fine-tune with datasets made by others, and attach open-source libraries and tools such as MCP servers. Supply chain security works by verifying the source at each of these steps, confirming with signatures and hashes that files match the originals, and checking for known vulnerabilities. An AI BOM, which keeps a list of what was used, is also part of this practice.
Supply chain checklist
Source
- Was it obtained from the official distributor?
- Was it verified against the original with signatures and hashes?
Content
- Is the training data free of manipulated examples?
- Are the libraries free of known vulnerabilities?
Records and isolation
- Were the components used recorded in an AI BOM?
- Was it tested in a sandbox first?
Why it matters
Attackers often find it easier to secretly plant problems in the components a service pulls in than to break into the finished service directly. Examples include data poisoning, which mixes manipulated examples into training data; backdoors hidden so that a model reacts abnormally only to a specific trigger; and model files that execute malicious code the moment they are loaded. A contaminated component can spread to the many services that use it, so the damage can be widespread.
Things to know
Unlike ordinary software, models are hard to inspect by reading their internals. A backdoor hidden among billions of numbers (parameters) does not readily show up in code reviews. That is why multiple layers of defense are used together, such as provenance tracking, testing in isolated environments (sandboxes) and red-team evaluations. The goal is not perfect blocking but 'knowing what was brought in from where, and being able to trace it quickly when a problem arises.'
Example
Suppose a company downloads an open-weight model from a public model hub to build an internal chatbot. Instead of using the model right away, the security team confirms the files come from the official distributor, requires a safe file format instead of formats that can contain executable code, and checks the libraries used alongside it for vulnerabilities. Plugins or MCP servers added later are reviewed through the same process and recorded in the list.