Research · AI Security

AI Supply Chain Security

AI applications depend on models, data sets, libraries and services built by others. AI supply chain security is about knowing what those components are, where they came from and whether they can be trusted.

The Model Provenance Loop

An AI application inherits the weaknesses of every model, dataset, library and hosted service it depends on. Most of those components come from outside the organization, often from public hubs where anyone can publish. The Model Provenance Loop is a CorpExcellence framework of five checkpoints that bring software supply chain discipline to AI components. It runs as a loop because components keep changing after deployment: models get new versions and advisories appear long after release.

Approve sources and scan artifacts

Start with an allow-list of model registries, publishers and API providers, and route all downloads through an internal mirror so nobody pulls a model straight from the internet into production. Treat model files as code. Some serialization formats can run commands when a model is loaded, so scan every artifact before anyone opens it and prefer weight-only formats such as safetensors. Scan the surrounding Python packages and containers with the same tools you use for application code.

Verify signatures and record provenance

Signing lets a consumer confirm that a model is exactly the one its publisher released. The OpenSSF Model Signing project released version 1.0 in April 2025, with support for Sigstore as well as conventional keys. Record each verified component in an AI bill of materials (AI BOM). CycloneDX defines machine learning models and datasets as component types and supports model cards, while SPDX 3.0 offers AI and dataset profiles. Pick one format and generate it in the build pipeline rather than by hand.

Gate deployment and keep watching

The last checkpoint turns the inventory into an enforcement point. Without it, the AI BOM is documentation that nobody reads.

• Block production use of any model that lacks an AI BOM entry and a verified signature.
• Track licenses and terms of use, since some open-weight models restrict commercial use.
• Subscribe to advisories for the models and frameworks you run, and match them against the AI BOM.
• Include hosted model APIs and agent tool servers, such as MCP servers, in the inventory.

Where the industry is now

As of September 2026, governments have moved from general SBOM advice to AI-specific expectations. In May 2026, CISA and its G7 cybersecurity partners published voluntary minimum elements for an SBOM for AI, grouped into clusters that include models, dataset properties, infrastructure and security properties. Although voluntary, the guidance gives buyers a reference point for procurement questions, so suppliers should be ready to produce an AI BOM on request. OWASP lists Supply Chain as LLM04 in its 2026 Top 10 for LLM Applications, and its Top 10 for Agentic Applications adds a separate entry for compromised tools, plugins and other agent components.

Common pitfalls

• Teams downloading models to laptops for experiments that quietly reach production.
• Inventorying open-weight models while ignoring the hosted APIs that carry most traffic.
• Treating a valid signature as proof of safety. It proves origin, not the absence of a backdoor.