Model & data supply chain

Framework of incremental supply-chain security levels, organized into Build and Source tracks. It recommends formats for signed statements about artifacts (attestations), including build provenance, which records how an artifact was built.

Open-source project for signing and verifying software artifacts with short-lived certificates tied to an identity. Signing events are recorded in the Rekor transparency log, a public append-only log that anyone can check.

Reference library and command-line tool (model_signing) for signing ML models with Sigstore, public keys or certificates. It verifies a model against a signed manifest of its file hashes. Version 1.0 was released in April 2025.

Format for a detached model signature, which is stored apart from the files it signs. The format does not depend on any one implementation. One signature covers the model's artifacts, such as weights, configuration files and tokenizers. It can use bare keys, certificate chains or Sigstore.

Specification for verifiable claims about how software was produced. It defines a standard statement format and vetted predicate types, which name the kind of claim being made. Sigstore's model signatures carry in-toto statements.

Project that defines and promotes reproducible builds. In a reproducible build, any party can recreate bit-for-bit identical artifacts from the same source, environment and instructions. This lets anyone check a binary against its source code.

IETF architecture for Supply Chain Integrity, Transparency and Trust (SCITT), published as a Proposed Standard. Issuers register signed statements about artifacts with a transparency service. The service records them in an append-only ledger and returns receipts showing that each statement was recorded.

CycloneDX capability for describing models, datasets and their dependencies in a machine-readable bill of materials, including dataset provenance and training methods. AI support arrived in CycloneDX 1.5. CycloneDX 1.6 was published as Ecma standard ECMA-424.

SPDX profile for documenting AI software packages, with fields such as autonomy type, energy consumption, safety risk assessment, training information and limitations.

Proposes model cards: short documents that accompany trained models and report their intended uses and evaluation results across relevant conditions and groups.

Audit that traces the sources, creators and licenses of more than 1,800 text datasets. On widely used hosting sites, it finds license information omitted in over 70 percent of cases.

Metadata format that gives ML datasets a shared, machine-readable description across tools, frameworks and repositories. MLCommons hosts its specification and code.

Shows two practical poisoning attacks on web-scale datasets, in which attackers plant bad data in a training set. One of them could have poisoned 0.01 percent of LAION-400M for about 60 US dollars. The paper also recommends low-overhead defenses.

Framework for attestable ML pipelines. It combines trusted hardware, transparency logs and open provenance specifications to record a model's lineage (the data and steps behind it) from training through deployment.

Coalition for Secure AI paper on model-signing roles, components and maturity levels. It includes NVIDIA's account of shipping an OpenSSF Model Signing (OMS) signature with every NVIDIA model published in its NGC catalog since March 2025.

Statistical tests of whether two language models, given their weights, were trained from independent random initializations (starting weights). One test, on matched hidden activations, resists adversarial changes and can locate components derived from another model. For example, it shows how Llama 3.1-8B was pruned to initialize Llama 3.2-3B.

Black-box framework that decides whether one LLM was derived from another by applying multiple hypothesis testing to their outputs. On benchmarks of more than 600 models, it reports 90–95% precision and 80–90% recall.

Experimental IETF protocol, now obsoleted by RFC 9162 (version 2.0). Public append-only logs built on Merkle trees (hash trees) record TLS certificates, so anyone can audit certificate authorities. Anyone can also check the logs: Merkle audit paths show that a certificate is included, and consistency proofs show that a log has only been appended to.

Proposes that every dataset be accompanied by a datasheet documenting its motivation, composition, collection process and recommended uses, by analogy with datasheets for electronic components.

Shows that a service provider entrusted with training can plant a backdoor that no observer with limited computing power can detect. In one construction, the backdoor stays undetectable even to someone given the full network and its training data.

Trains proof-of-concept LLMs with backdoors, such as writing exploitable code when the prompt states that the year is 2024. The paper finds that supervised fine-tuning, reinforcement learning and adversarial training can fail to remove them. Adversarial training sometimes teaches the models to hide the behavior.

Pretraining experiments on models from 600M to 13B parameters, in which 250 poisoned documents implanted a backdoor at every scale. This indicates that the number of poison samples an attack needs stays near-constant as models and datasets grow.

Mandatory template under Article 53(1)(d) of the EU AI Act for the public summary of training content. Providers of general-purpose AI models must publish this summary. It covers data sources such as large public datasets, the most-scraped web domains and user data.

Voluntary UK code that sets 13 baseline security principles for AI systems across five lifecycle phases. The principles include securing the supply chain; documenting data, models and prompts; and re-running evaluations on released models before use.

Tree-based tamper-evident log, which makes any later deletion or change detectable. An untrusted logger can prove that events are still present and that the log is consistent with earlier versions. The proofs stay small, growing only logarithmically with the log's size.