What attackers do. This is a technique from MITRE ATLAS, the companion knowledge base for attacks on AI systems. Attackers compromise parts of the machine learning supply chain, such as pre-trained models, datasets, ML libraries or model hosting platforms, so that victims build or run systems containing hidden weaknesses or malicious code.
How to defend. Source models and datasets from trusted providers, verify hashes and signatures, and keep an inventory of models and their origins. Prefer safe model serialisation formats over ones that can execute code when loaded, scan models before use and pin library versions. Evaluate third-party models for unexpected behaviour before deployment.
Signs to look for. Look for models or datasets downloaded from unverified sources, model files that run code on load and unexpected network activity from training or inference environments. A common gap is treating models as data rather than as code that needs review.