AID-H-003: Secure ML Supply Chain Management
Apply software supply-chain security throughout the AI/ML lifecycle: admit trusted inputs, promote and distribute exact signed releases, control protected model delivery to clients or edge devices outside the enterprise trust boundary, and remediate vulnerabilities in deployed AI software. The aim is to prevent malicious, tampered, vulnerable, or unauthorized model and software bytes from entering, leaving, or remaining exploitable in the system.
Scope boundary
Owns preventive admission, promotion, and distribution controls for third-party software, datasets, hardware, infrastructure definitions, models, adapters, manifests, signatures, unsafe serialized artifacts, and protected client/edge model releases outside the enterprise trust boundary, plus continuous vulnerability remediation for deployed AI application and platform software. Accelerator firmware and driver remediation remains under AID-H-009.002.
Sub-techniques
- AID-H-003.001: Software Dependency & Package Security
- AID-H-003.002: CI/CD Release Gating, Model Artifact Signing & Secure Distribution
- AID-H-003.003: External Dataset Supply-Chain Provenance Admission
- AID-H-003.004: Hardware/Firmware Attestation & Cluster Admission
- AID-H-003.005: Infrastructure as Code (IaC) Security Scanning for AI Systems
- AID-H-003.006: Model SBOM & Provenance Attestation
- AID-H-003.007: Adapter / PEFT (Parameter-Efficient Fine-Tuning) Supply Chain Integrity & Provenance Verification
- AID-H-003.008: Crypto-Agile Artifact Signing & Distribution (PQC-Ready)
- AID-H-003.009: Model Artifact Static Malware & Unsafe-Serialization Scanning
- AID-H-003.010: Deployed AI Software Vulnerability Remediation Lifecycle
- AID-H-003.011: Attested Edge Model Entitlement & Key Release
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.000 AI Supply Chain Compromise: Hardware
- AML.T0010.001 AI Supply Chain Compromise: AI Software
- AML.T0010.002 AI Supply Chain Compromise: Data
- AML.T0010.003 AI Supply Chain Compromise: Model
- AML.T0010.004 AI Supply Chain Compromise: Container Registry
- AML.T0011 User Execution
- AML.T0011.000 User Execution: Unsafe AI Artifacts
- AML.T0011.001 User Execution: Malicious Package
- AML.T0018 Manipulate AI Model
- AML.T0018.000 Manipulate AI Model: Poison AI Model
- AML.T0018.002 Manipulate AI Model: Embed Malware
- AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
- AML.T0020 Training Data Poisoning
- AML.T0025 Exfiltration via Cyber Means
- AML.T0044 Full AI Model Access
- AML.T0049 Exploit Public-Facing Application
- AML.T0060 Publish Hallucinated Entities
- AML.T0074 Masquerading
- AML.T0076 Corrupt AI Model
- AML.T0109 AI Supply Chain Rug Pull
- AML.T0112.001 Machine Compromise: AI Artifacts
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.001 Publish Poisoned AI Artifacts: Models
- AML.T0119 Exploit Automated Artifact Processing Pipeline
- AML.T0120 AI Artifact Repository
- AML.T0122 Exploitation of Remote Services
MAESTRO
- Model Stealing (L1)
- Backdoor Attacks (L1)
- Data Tampering (L2)
- Compromised Framework Components (L3)
- Supply Chain Attacks (L3)
- Compromised Container Images (L4)
- Orchestration Attacks (L4)
- Infrastructure-as-Code (IaC) Manipulation (L4)
- Lateral Movement (L4)
- Supply Chain Attacks (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM04:2026 Supply Chain
- LLM05:2026 Data and Model Poisoning
OWASP ML Top 10 2023
- ML05:2023 Model Theft
- ML06:2023 AI Supply Chain Attacks
- ML07:2023 Transfer Learning Attack
- ML10:2023 Model Poisoning
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
NIST Adversarial Machine Learning 2025
- NISTAML.023 Backdoor Poisoning
- NISTAML.026 Model Poisoning (Integrity)
- NISTAML.051 Model Poisoning (Supply Chain)
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-6.1 Training Data Poisoning
- AITech-7.3 Data Source Abuse and Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-8.4 Prompt/Meta Extraction
- AITech-9.2 Detection Evasion
- AITech-9.3 Dependency / Plugin Compromise
- AITech-10.1 Model Extraction
- AITech-14.1 Unauthorized Access
- AISubtech-1.1.1 Instruction Manipulation
- AISubtech-7.3.1 Corrupted Third-Party Data
- AISubtech-8.4.1 System LLM Prompt Leakage
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-9.2.1 Obfuscation Vulnerabilities
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- UTD: Unauthorized Training Data
- MST: Model Source Tampering
- MXF: Model Exfiltration
- MDT: Model Deployment Tampering
- IIC: Insecure Integrated Component
Databricks AI Security Framework 3.0
- Raw Data 1.6: Insufficient data lineage
- Raw Data 1.7: Lack of data trustworthiness
- Raw Data 1.8: Legality of data
- Raw Data 1.11: Compromised 3rd-party datasets
- Governance 4.1: Lack of traceability and transparency of model assets
- Algorithms 5.4: Malicious libraries
- Model 7.1: Backdoor machine learning / Trojaned model
- Model 7.2: Model assets leak
- Model 7.3: ML Supply chain vulnerabilities
- Model Management 8.1: Model attribution
- Model Management 8.2: Model theft
- Operations 11.1: Lack of MLOps - repeatable enforced standards
- Platform 12.1: Lack of vulnerability management
- Platform 12.5: Poor security in the software development lifecycle
- Agents - Tools MCP Client 13.35: Update and Patch Management