AsrielNetworksModel supply chain
Compromise of the artifacts an AI system is assembled from: weights, adapters, datasets, tool servers and the packages that load them.
Definition
The model supply chain is everything an AI system is assembled from before it answers a request: base weights and fine-tuned adapters, the datasets that produced them, serialisation formats that can execute code on load, inference servers and their dependencies, prompt templates, and the tool servers and retrieval corpora the running system pulls in. Compromise anywhere in that chain ships a system that behaves for its author, not its operator.
The runtime-facing parts of the chain, MCP servers and retrieval corpora, are the ones a detection platform can observe directly; weights and datasets are a provenance and evaluation problem, handled before deployment.
How it manifests
- Backdoored weights: a model that behaves normally until a trigger phrase, date or context appears.
- Unsafe artifact formats: pickle-based checkpoints that run code on load; unpinned downloads from public hubs.
- Poisoned fine-tuning or RLHF data that installs a bias or an instruction.
- Tool-layer compromise: an MCP server whose description or behaviour changes after adoption; a retrieval corpus anyone can write to.
How AsrielNetworks detects it
No built-in rule inspects weights or datasets; that belongs in the release pipeline, with provenance checks and the evaluation lab's probes. The supply_chain category in AsrielNetworks covers the parts of the chain that appear in a trace: MCP tool poisoning and shadowing, and retrieval poisoning. A backdoored model's behaviour still shows up downstream as excessive agency or exfiltration, and those rules carry it into an incident.
- MCP tool poisoning
ai.mcp.tool_poisoning· high
Model-directed instructions inside an MCP tool description, or a description that changed between sightings in one trace. - RAG poisoning or contamination
ai.rag.poisoning· medium
A suspicious retrieved document, distinguished from confirmed influence over a risky action.
References
- OWASP GenAI Security Project, LLM03:2025 Supply Chain.
- Hubinger et al., Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training (2024).
- MITRE ATLAS, AML.T0010 AI Supply Chain Compromise.
- Hugging Face, Pickle scanning and safetensors, on artifact formats that execute on load.