Unverified Data & Model Provenance

Datasets, base models, and adapters are pulled from public hubs without signatures, hashes, or an AI bill of materials.

Impact

Teams cannot tell which upstream component introduced a backdoor or license violation.

Why this severity

Impact High × Likelihood Medium = High

Impact high: compromised components cannot be traced. Likelihood medium: namespace reuse and organization impersonation on model hubs are demonstrated.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: Model Namespace Reuse Supply Chain Attack (MITRE ATLAS case study AML.CS0065, 2025)
Demonstration: Organization Confusion on Hugging Face (MITRE ATLAS case study AML.CS0027, 2023)

Exploited by

Training & Fine-Tune Data Poisoning Threat · High severity
Malicious Model Artifacts Threat · Critical severity
Hallucinated Package Squatting Threat · High severity

Mitigated by

Signed Model Registry & AIBOM Guardrail · Fixes critical risks
Dataset Provenance & Poison Screening Guardrail · Fixes high risks

Remediation

Maintain an AIBOM listing every dataset, model, and adapter with digests.
Mirror approved artifacts into an internal registry.
Require signed attestations for third-party components.

How to verify

Every deployed model resolves to a complete AIBOM entry.
Builds fail when an artifact lacks a matching signature.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM03:2025 Supply Chain
LLM04:2025 Data and Model Poisoning

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise

NIST AI RMF 1.0

MAP 4.1 Risks of AI components, including third-party data and software, are mapped
GOVERN 6.1 Policies address AI risks from third-party entities