AI Security Atlas › All entries › Model Supply Chain & Training Integrity
Signed Model Registry & AIBOM
Only signed, hash-pinned artifacts with a recorded bill of materials can be promoted to training or serving.
Open in the interactive atlas →Impact
Breaks the supply-chain path from a public hub to production inference.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Unverified Data & Model Provenance (High), Malicious Model Artifacts (Critical).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Unverified Data & Model Provenance Vulnerability · High severity
- Malicious Model Artifacts Threat · Critical severity
Needed by
- Safe Artifact Loading Policy Guardrail · Fixes critical risks
Remediation
- Sign artifacts at build time (e.g. Sigstore) and verify at load.
- Record base model, datasets, and adapters in the AIBOM.
- Block promotion when a dependency is revoked upstream.
How to verify
- Tampered weights fail verification in the serving bootstrap.
- AIBOM diff is attached to every model release.
Pattern
verifySignature(artifact, trustRoot);
assert(artifact.digest === manifest.digest);Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM03:2025 Supply Chain
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
MITRE ATLAS
NIST AI RMF 1.0
- GOVERN 6.1 Policies address AI risks from third-party entities
- MANAGE 3.1 Third-party AI risks are monitored and controls applied