~/promptexploit.com/posts/llm03-2025-supply-chain-simple-explanation

promptexploit

i'm feeling ★ adversarial ★
LLM032026-06-04llm03-supply-chain.md

LLM03:2025 Supply Chain - Simple Explanation

Supply chain risk means your AI app can be hurt by something you depend on. That dependency might be a Python package or a model file or a dataset or a LoRA adapter or a cloud platform.

Think of it like buying parts for a machine. Your own assembly can be careful. But if one part arrives with a hidden defect the whole machine can fail. In AI the hidden part may be a model weight file or training data or an adapter from a model hub.

Why this is different

Classic application security already worries about vulnerable libraries and outdated dependencies. LLM apps add a new layer. You may also depend on pre-trained models and fine-tuning adapters and model conversion services and external AI gateways.

This matters even if you do not train your own model. If your app calls a third-party model through a proxy or middleware then that proxy is part of your supply chain too.

Where risk enters

01
PackagesOld or vulnerable libraries can compromise an LLM app.
02
LicensesSoftware and dataset terms can create legal risk.
03
Old modelsDeprecated models may stop receiving fixes.
04
Pre-trained modelsA model can hide bias or backdoors or malicious behavior.
05
Weak provenanceModel cards do not prove where a model really came from.
06
LoRA adaptersA small adapter can change the behavior of a trusted base model.
07
Shared workflowsModel merge and conversion services can become attack paths.
08
On-device modelsMobile or edge apps can be repackaged with tampered models.
09
Terms and privacyA supplier may use app data for training in ways you did not expect.

LLM03 versus LLM04

LLM04 focuses on data and model poisoning itself. LLM03 focuses on how the bad artifact enters your stack. The same attack may touch both risks. The boundary is about the path of trust.

LLM03 supply chain

How a bad model or adapter or package gets accepted by your system.

LLM04 poisoning

How training data or model behavior gets corrupted.

Attack patterns

01
Vulnerable libraryA Python dependency lets attackers compromise the AI app.
02
PoisonGPT style tamperingA model is changed directly so it spreads false answers.
03
Benchmark evasionA model scores well on tests but hides targeted triggers.
04
Malicious adapterA LoRA adapter changes a base model after it is merged.
05
Cloud platform attackFirmware or cloud control issues expose model platforms.
06
GPU memory leakLeftover local memory can reveal sensitive model activity.
07
Name squattingA fake model uses a trusted name after the real one disappears.
08
Mobile repackagingAn app is rebuilt with a tampered model and sent to users.

Unsafe model loading

One common danger is treating a model file like passive data. Some model formats or loading paths can execute code during load. The classic warning pattern is a pickle file that runs a reverse shell through a special reduce method when the server loads it.

How to defend against it

01
Vet suppliersReview data sources and model providers and their policies.
02
Use provenance checksPrefer verifiable sources and signed artifacts and hashes.
03
Keep an inventoryTrack packages and datasets and models with SBOM or AI BOM records.
04
Patch dependenciesScan and update libraries and model serving infrastructure.
05
Red team modelsTest third-party models for the exact use case you plan to ship.
06
Monitor shared workflowsAudit merge and conversion environments for abuse.
07
Manage licensesTrack software and dataset rights before commercial use.
08
Protect edge modelsUse encryption and integrity checks and device attestation.

Legal and compliance risk

Supply chain risk is not only technical. A model or dataset can carry license duties that affect distribution or commercial use. A supplier can also change its terms and start using application data for training. That can create privacy and compliance problems.

This is why AI BOMs and model provenance are becoming important. Teams need to know what they run and where it came from and what rules apply to it.

Framework mapping

OWASP maps this risk to MITRE ATLAS AML.T0010 - ML Supply Chain Compromise. Unsafe model artifact cases also relate to techniques around malicious model artifacts and unsafe ML serialization.

One sentence: LLM03 is the risk that a model or adapter or dataset or package you trusted was already compromised before it reached your app.

Copyright and source notes

No third-party images are embedded in this post. The diagrams above are original HTML/CSS illustrations made for promptexploit. The factual risk description and mitigation categories are based on the official OWASP LLM03 page.