auditing-ml-model-supply-chain

# Auditing the ML model supply chain: a model file is code you run A model file is usually treated as inert data, a bag of weights. Many formats are not: loading one can execute arbitrary code embedded in the file, and even a pure-weights model can carry a backdoor that changes behavior on a trigger. The moment your pipeline loads a model someone else produced, that model is untrusted code and untrusted logic entering your system, on the training host, the inference server, or a developer's laptop. ## When to use - You are adding a model, checkpoint, or weights file to a training or inference pipeline. - You are reviewing where and how models are loaded, and from where. - You are vetting a third-party or publicly-hosted model before you trust it. ## Scope check Audit models and pipelines you own or are authorized to test. Do not load or execute untrusted model files outside a contained environment. If you can't name the authorization, stop. ## The loop 1. **Inventory every model load path and its format.** List where the system loads a model, checkpoint, or weights file, who produced each one, and the serialization format. Formats that can reconstruct arbitrary objects execute code on load; formats that carry only tensors are safer. Mark each load site by format risk. 2. **Check for code execution on load (the RCE leg).** For any load path using a format that can rebuild arbitrary objects, a malicious file runs code the instant it is loaded, before an...