AI Supply Chain Security 2026: SBOM, Model Provenance, HuggingFace Pickle Exploits

Q: What is the AI supply chain, and how does it differ from the traditional software supply chain?

The AI supply chain covers four asset categories that the traditional software-supply-chain framing does not cleanly include: model weights (gigabytes-to-terabytes of opaque tensors plus deserialisation code, downloaded from a public or private registry and executed inside the application process), training and fine-tuning datasets (text, image, audio, code corpora often assembled from public scrapes and third-party labelled sets), custom-code adapters (tokenisers, processors, custom model classes shipped alongside weights and loaded through the trust_remote_code escape hatch), and the AI-specific Python dependency tree (transformers, torch, vllm, langchain, hundreds of integration packages with rapid release cadences). Each category has its own threat model. Model weights are vulnerable to deserialisation RCE (the pickle problem), embedded backdoors (model behaves normally except on trigger inputs), and stealth fine-tune contamination (safety alignment removed by a small adversarial fine-tune). Datasets are vulnerable to poisoning and provenance laundering. Custom-code adapters are simply arbitrary code from the model author with the application privileges. The dependency tree inherits classical software supply-chain risks plus AI-specific amplifications (a compromised transformers package can rewrite weight-loading logic to insert backdoors at load time). The shape of the defence is the same shape as a mature container supply chain (ingestion gate, private registry, signed artefacts, attestation, fleet-side verification) but the model-specific scanners, attestation formats, and refuse-pickle policies are the AI-specific additions.

Q: Why is the HuggingFace pickle problem so dangerous, and what is the safetensors migration?

Pickle is Python native object-serialisation with a documented and intentional feature that the format supports arbitrary callable execution as part of deserialisation: an object can define __reduce__ to return any function and any arguments, and pickle.load will invoke that function during unpickling. The Python documentation has carried the warning that loading a pickle from an untrusted source is equivalent to executing arbitrary code since the format inception. PyTorch historical default weight-serialisation format is pickle (the .bin and .pt files are pickle archives), torch.load deserialises with pickle by default, transformers from_pretrained calls torch.load under the hood, and the data-scientist habitual AutoModel.from_pretrained("some-org/some-model") invocation executes whatever code the model pickle archive contains from a public registry with the application full privileges. The harvesting pattern is straightforward: upload a model whose pickle payload runs subprocess.Popen to a reverse-shell server, write a credible model card, accumulate downloads; every download is a reverse shell. safetensors is the HuggingFace-designed alternative explicitly free of arbitrary-code execution: tensors stored as raw bytes with a JSON metadata header, deserialisation is a memory-mapped read with no callable invocation. Every popular model has a safetensors variant. The architectural rule is non-negotiable: production model-loading code refuses pickle weights unconditionally, accepts only safetensors. The migration is mature; the cost of carrying pickle support is the entire arbitrary-code-execution surface. The adjacent failure mode is trust_remote_code=True which loads custom Python modules shipped alongside weights; the flag is the second-largest arbitrary-code-execution vector and should be permitted only against a reviewed allowlist of model identifiers with pinned commit hashes.

Q: What is an SBOM for AI, and what should it contain?

The Software Bill of Materials discipline that emerged from the SolarWinds incident landed at the rule that every artefact you ship and every artefact you depend on is enumerated, versioned, and signed. The AI-specific SBOM adds the model and dataset categories to that enumeration. Format-level work has been done by CycloneDX 1.5+ with the ML-BOM extensions (ml:model, ml:dataset, ml:framework component types) and by SPDX 3.0 with similar coverage. The minimum AI SBOM payload for a deployed application includes: every model with name, version, source registry, weight-file hashes, format (safetensors vs pickle), licence, and provenance attestation pointer; every dataset used in training or fine-tuning with source, licence, version hash, and consent-basis documentation; every Python package with name, version, source registry, package hash, and the resolved dependency tree to leaf packages; every base-container image with digest and base-image lineage; the application own commit hash and build attestation. The payload is large for a non-trivial ML application (hundreds of components is typical) and the generation has to be automated as part of the build pipeline. Manual SBOM authorship does not scale and falls out of date by the second build. The point of the SBOM is not the document itself but the machine-actionable substrate it provides for downstream controls: vulnerability scanning (does this SBOM contain any package with a known CVE), policy enforcement (does this SBOM contain any model whose licence is incompatible with our usage), provenance verification (does every component have a valid signature), and incident response (which deployed applications depend on the model we just learned was backdoored). Without the SBOM the response to a backdoor disclosure is a manual investigation; with it the response is a query.

Q: How do Sigstore, Cosign, and in-toto apply to model artefacts, and what is the Linux Foundation Model Signing project?

Sigstore is the cross-industry signing infrastructure that has become the de-facto standard for open-source artefact signing. Cosign signs and verifies artefacts; Fulcio issues short-lived signing certificates tied to OIDC identity; Rekor is the public transparency log that records every signature so that a malicious signature would be publicly detectable. A model weight file signed with Cosign produces a signature verifiable against the signer OIDC identity (a GitHub Actions workflow, a GitLab CI job, a corporate identity provider). The 2024 Linux Foundation Model Signing project under the OpenSSF umbrella extended Sigstore-style signing to multi-file model packages with manifest-level signatures that cover all the weight shards, the config, the tokeniser, and the SBOM as a single attestation; the reference implementation fits cleanly into the model-publishing CI/CD pipeline. in-toto is the framework for capturing the full provenance graph: not just who signed the final artefact but what steps produced it, in what order, with what inputs, on what infrastructure. An in-toto attestation for a model records the dataset version that fed the training, the training-script commit hash, the compute environment, the hyperparameters, the duration, and the output weight-file hash. The SLSA (Supply-chain Levels for Software Artefacts) framework that emerged from in-toto provides a maturity ladder; SLSA Level 3 is the realistic 2026 target for security-mature enterprises. The composed architecture is that every model the organisation publishes has a Cosign signature, an in-toto provenance attestation, and a CycloneDX ML-BOM, all bound together through the manifest signature; every model the organisation consumes passes a verification gate that checks the signature against an allowed signer set, the provenance against a policy, and the SBOM against scanners.

Q: What does the reference ingestion-gate architecture look like, and what tools belong at each stage?

The architecture is a single ingestion gate that every model artefact passes through, a private registry that holds only post-gate artefacts, and an inference fleet that pulls only from the private registry and verifies signatures at load time. The shape is identical to a mature container-image supply chain. The ingestion gate has four checkpoint stages. Stage 1 deserialisation scanning: picklescan is the open-source scanner for malicious imports inside pickle archives via static analysis of pickle opcodes for the GLOBAL and REDUCE patterns that indicate arbitrary-code execution; modelscan (Protect AI open-source) extends to TensorFlow and Keras formats with a broader rule set; Protect AI commercial Guardian wraps both with additional rules and CI/CD integration. Stage 2 CVE and licence scanning: pip-audit, grype, osv-scanner, Trivy applied to the dependency tree with the AI/ML CVE database maintained by Protect AI plus the GitHub advisory database ML categories; dataset licence scanning is the AI-specific addition with consent-basis tracking for EU AI Act compliance. Stage 3 signature and provenance verification: Cosign verify against an allowed-signer set (organisation own CI identities plus a curated list of upstream publishers like Meta official Llama signing identity), in-toto policy verify against a configured provenance policy. Stage 4 the private registry itself: HuggingFace Enterprise tenant, self-hosted MLflow model registry, ZenML or DVC artefact store, or an OCI registry repurposed for model artefacts. The fleet-side enforcement is the last defensive line: the model-loading code path verifies signatures at load time, refuses pickle weights regardless of source, refuses trust_remote_code outside the allowlist, and emits load-time telemetry the security operations centre can audit. The gate is the chokepoint where the defence concentrates; the upstream registries and storage backends are replaceable around it.

Q: How does dataset lineage fit into the supply-chain discipline, and what does the EU AI Act require?

The dataset lineage, licence, and consent basis are part of the supply chain and need the same treatment as model weights and code. The lineage manifest records for each dataset used in training or fine-tuning: the source (URL, repository, original publisher), the version hash (so that subsequent dataset modifications are detectable), the licence (with the application commercial-use eligibility verified against the licence terms), the consent basis where personal data is involved (GDPR Article 6 lawful basis, DPDPA notice and consent equivalent), and any data-quality processing applied (deduplication, filtering, augmentation). The discipline matters for three reasons. First, training-time poisoning is one of the highest-impact attacks against ML systems because a small fraction of the training data crafted to embed a backdoor or bias can produce behavioural changes that survive every subsequent fine-tune; the only defence is dataset provenance combined with version-pinning of the dataset hash at training time so that subsequent changes to the source dataset do not silently propagate. Second, the EU AI Act data-governance obligations make this a regulatory requirement for high-risk systems: Article 10 requires documented data-governance practices covering relevance, representativeness, appropriate examination for biases, and identification of data gaps; the obligation cannot be met without dataset lineage as a first-class artefact. Third, dataset licences change retroactively (HuggingFace datasets have had this happen): a dataset that was permissively licensed at training time may be republished with restrictive terms, and the organisation needs the lineage to know which deployed models were trained on the dataset before the licence change. The lineage manifest is the SBOM equivalent for datasets and belongs in the CycloneDX ML-BOM payload alongside the model components.

Q: What is the five-stage maturity ladder for AI supply-chain security, and where should organisations target by end-2026?

Stage 0 baseline: models pulled directly from HuggingFace into production, pickle weights accepted, trust_remote_code=True permitted without review, no SBOM, no provenance attestation; most organisations sit here in early 2026 and the security posture is at the level the application community had in 2015. Stage 1 private registry: a private model registry exists, production pulls from it, the ingestion process is manual review; pickle still accepted, trust_remote_code use is informal; SBOM exists for container images but not for models; the architecture has reduced attack surface but the ingestion gate is human-bottlenecked and inconsistent. Stage 2 automated gate: automated ingestion gate with picklescan and modelscan, pickle weights refused at the gate, trust_remote_code allowlist enforced, CycloneDX ML-BOM generated for every ingested model, CVE and licence scanning on the dependency tree; the architecture is materially defensive and the residual attack surface is the sophisticated stealth threat. Stage 3 signed provenance: Cosign signing of every internally-published model, in-toto provenance attestation on every internal training run, SLSA Level 3 build pipelines, signature verification at load time in the inference fleet, dependency hash-pinning, private-index priority; the architecture meets the SLSA 3 bar and is the practical 2026 target for security-mature organisations. Stage 4 adversarial discipline: adversarial evaluation in the ingestion gate, activation-pattern analysis on critical models, continuous behavioural-drift monitoring in production, cross-organisation threat-intelligence sharing on flagged models; the architecture addresses the sophisticated-threat surface and is the late-2020s horizon for the leading organisations. The end-2026 target for the realistic majority of enterprises is Stage 3; organisations at Stage 0 in early 2026 can practically reach Stage 2 in a quarter and Stage 3 by year-end with focused investment.

Q: What is the Monday-morning checklist for an organisation that has done none of this?

In 24 hours: audit production for any model loaded from a public registry and list the model identifiers and the application paths; disable trust_remote_code=True in any production code path that currently uses it without an allowlist; document every model currently in production with source registry, weight format, and licence. In 7 days: stand up a private model registry (HuggingFace Enterprise, MLflow, or an OCI registry repurposed for model artefacts); mirror all currently-used third-party models into the private registry with the safetensors variant only and reject the pickle variants; update the production model-loading code path to refuse non-safetensors weights and to enforce the trust_remote_code allowlist; generate a CycloneDX ML-BOM for every model in the registry. In 30 days: deploy picklescan and modelscan at the ingestion path configured fail-closed so scanner errors block ingestion; integrate pip-audit or osv-scanner for the dependency tree and configure hash-pinning in requirements.txt; configure private-index priority in the package-resolution rules; begin Cosign signing of internally-published models and configure signature verification at the inference-fleet model-loading path. In a quarter: deploy in-toto provenance attestation on the internal training pipeline targeting SLSA Level 3; build the dataset-lineage manifest as a first-class artefact with licence and consent-basis tracking; begin adversarial-evaluation integration in the ingestion gate for the highest-risk model classes; integrate the SBOM with the incident-response runbook so the which-apps-depend-on-this-model query is one command not a manual investigation. The sequence delivers the Stage 3 maturity bar in a quarter from a Stage 0 start and removes the easy-target classification that makes the harvesting operations profitable.