AI Security Testing: LLM-03 Supply Chain Testing

Learn to verify the LLM supply chain by auditing artifacts, dependencies, licenses, and pipeline gates, determine what can be scanned or reviewed, and report evidence to QA engineers.

Clarify the LLM supply chain and establish the chain of trust across models, tokenizers, data sets, and inference services. Turn trust decisions into visible checks before runtime.

Scan the requirements file with pip-audit to flag vulnerable third-party Python packages, ML frameworks, and transitive dependencies before production, using CVE data as release risk evidence.

Explore how transitive dependencies from PiPI and private mirrors create trust risks in llm stacks, and learn to surface vulnerabilities through CVEs before release.

Highlight framework-level risk with Ray, a distributed AI framework; its control of jobs, production data, and credentials can expose secrets, demanding version tracking, CVE scanning, and restricted dashboards.

demonstrates using pip-audit to scan Python dependencies for known vulnerabilities, producing full scan output and a concrete QA release gate with a vulnerable and a clean file.

Assess dependency risk by scanning shipped dependencies for known vulnerabilities, collect evidence (scan output, package name, installed version, CVE, fixed version), and implement QA control CI/CD gates to block releases.

Treat the model file as a trusted supply-chain component, and verify provenance, version, and safe loading path with three controls: provenance review, serialization format review, and hash verification.

Treat model files as distinct from source code and layer quality assurance checks to verify source, artifact identity, loading path, and behavior against release baseline to mitigate supply chain risks.

Explore the provenance gap in model supply chains and why model cards do not prove origin. Verify publisher accounts, model card versions, file hashes, and artifact identifiers for QA.

Poison GPT demonstrates model artifact risk from post-training weight edits, not poisoned data, including Rhoam model editing. QA must use behavioral baselines and workflow-specific tests beyond benchmarks.

Learn how pickle deserialization can execute code when loading untrusted model files, and how SafeTensors mitigates this risk, guiding QA to verify source, hash, and behavior before loading.

Demonstrate a scenario and test plan for AI security testing by loading a pickle-based model from an unsafe path to reveal code execution, and compare with safer loading and SafeTensors.

Demonstrate that pickle deserialization during model loading can execute code via the reduce method, creating an unsafe load path; show protected loading with weights only true and SafeTensors as alternatives.

Untrusted pickle-based model files loaded via unsafe deserialization in torch.load risk code execution, highlighting missing loading policy. Implement weights-only checks and SafeTensors, with a model source allow list.

Verify artifact identity with hash verification using SHA-256 as a fingerprint to detect changes before loading models in the deployment pipeline, blocking deployment on mismatches.

Demonstrate how a pie-tourge model used pickle's reduce to execute a payload on load and open a reverse shell, highlighting QA controls like source verification and serialization checks.

Verify the source, artifact identity, and loading path to ensure safe model deployments; provenance review checks origin, hash verification confirms integrity, serialization format review prevents unsafe deserialization.

Discover how behavioral regression testing detects upstream changes that alter system behavior after a release, by comparing current model behavior to an approved baseline and deciding if investigation is needed.

Investigate model swap and behavioral tampering through bug report and post-mortem, detailing baseline comparisons, exposure, and how two-stage validation gates prevent unsafe deployments.

Samsung faced data exposure risk when sensitive internal data flowed to an external AI supplier, exposing data path, retention, and supplier terms concerns that QA should verify before use.

Treat licensing as a supply chain check in AI security testing. QA flags dependencies, captures evidence, and routes findings to license owners to prevent production release with restricted licenses.

Understand how terms of service and privacy policies govern external providers in the LLM supply chain, including data handling, updates, opt-out settings, and QA validation.

Explore three QA verification tracks—license auditing, supplier term review, and data set provenance—and learn how verifiable evidence and release gates protect supply chain integrity.

Learn how to enforce supply chain controls for LLM systems using AI BOMs and hash verification, establishing release gates, inventories, and signed artifacts.

The ai bom extends the s-bom to cover model files, adapters, prompts, and policies, creating a two-layer inventory of code and intelligence to verify, trace sources, and ensure release readiness.

Learn how hashes prove a model file matches the approved baseline while signing and internal self-signing with an internal registry strengthen release gates for quality assurance.

Define release gates for supply chain risk by converting evidence into decisions with defined severity, owner, and closure evidence, ensuring blocked releases for critical findings and documented exceptions.

Verify that the release decision is backed by current S bomb and AI bomb evidence tied to the release candidate, including artifact identity via hashes, signatures, or registry digests.

Explore where LLM workloads run and how infrastructure choices affect supply chain risk, including cloud, managed platforms, and on-device deployments, and identify evidence QA must verify for approved release path.

Validate cloud infrastructure isolation before release by checking driver versions, container configurations, and isolation mode, ensuring shared hardware does not expose data.

QA verifies release path evidence for both cloud infrastructure and on-device deployments, checking isolation profiles, artifact integrity, and behavioral baselines to gate before shipment.

Explore how supply chain risk spans cloud and on-device deployments, from hardware isolation and trusted baselines to tampered models, artifact hashes, and release-record evidence verified by QA.

Turn llm3 risk areas into a quality assurance test plan for ci/cd gates using supply chain evidence. Establish ownership and actionable bug reports to guide release decisions when gates fail.

Map the test matrix to the release pipeline, detailing pre-merge audits, identity checks, model hash verification, license scans, and final gate evidence with severity rules.

Verify the supply chain with LLM3 testing by applying three pillars: code layer audits, asset provenance checks, and runtime system verification, ensuring owners provide evidence and no single gate suffices.