The set of third-party models, datasets and libraries incorporated into an AI system, most often adopted without verification.
Few organizations train a model from scratch: they start from a published model, tune it on their own data, and add datasets and libraries drawn from public repositories. This chain mirrors that of open source software, with two differences that worsen the risk. A weights file is not readable, so no code review detects anything in it, and some of the serialisation formats in use permit arbitrary code execution when the model is loaded, which turns a download into an execution. A provenance difficulty compounds this, since public model licenses are heterogeneous and sometimes incompatible with commercial use, and training data is rarely documented, so a deployer inherits exposures it cannot inventory. The remedies mirror those of software, comprising a component inventory, artifact signing and a preference for serialisation formats that execute nothing, the last being the most effective and the easiest to mandate.
A security research team reported in February 2024 the presence, on a large public model-sharing platform, of around a hundred models containing malicious code executed on loading, exploiting a serialisation format that permits arbitrary execution.
AI supply chain, poids ouverts, open weights, dépôt de modèles