Revisit the weakest model supply-chain control

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R11 — HF Hub security

   R12 — Safetensors

   R36 — Syft/Grype

   R37 — SLSA/Sigstore

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Inspect your weakest model supply-chain control across P1–P3 (artifact source verification, trust_remote_code blocking, transitive dependency pinning, SHA-256/signature verification, or safe tensor loading) and harden it.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Write a new negative supply-chain test in D12 that would have bypassed your earlier implementation and verify it now fails closed.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Hardened D12 supply-chain control and new regression test.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R11Hugging Face Documentation↗ huggingface.co

  Model cards, tokenizer/config files, embedding usage, and repository commit-hash revision pinning.

• R12Safetensors Documentation↗ huggingface.co

  Zero-copy safe tensor format overview vs. unsafe pickle deserialization risks.

• R36Syft, Grype & Trivy (SBOM)↗ anchore.com

  CycloneDX/SPDX SBOM generation, container image scanning, dependency vulnerability detection, and scanner limits.

• R37SLSA & Sigstore↗ slsa.dev

  Supply-chain Levels for Software Artifacts (SLSA), build provenance attestations, and Cosign artifact signing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsHugging Face · Format docs
  Safetensors

  The assigned reading on the zero-copy tensor format: a JSON header plus raw tensor bytes, with no object graph to reconstruct, which is precisely why it closes the pickle load-time execution path.

  R12checked 2026-11-11
• videoSANS Internet Storm Center · News segment
  SANS Stormcast Tuesday Feb 19th: ModelScan AI Model Security; OpenSSH Vuln; Juniper Patches; De…

  A short segment on inspecting AI models for deserialization attacks, naming the scanner and the class of payload it looks for — the artifact-verification step for your weakest supply-chain control.

  R11R36checked 2026-11-11
• videoConf42 DevSecOps (Emmy Eide) · Conference talk
  Your SBOM Stops at the model

  Argues that package-level SBOMs go clean while the model artifact carries the most capability, and covers unsafe deserialization, trust_remote_code, and tensor-level tampering as separate controls.

  R36R37checked 2026-11-11
• articleThe Layman Security · 15 min read
  AI Supply Chain Security: Pickle, Safetensors, ML-BOM

  Includes a harmless tested pickle demo that executes on load, the JFrog findings, and the concrete defence list (safetensors-only, source allowlist, scan before load, ML-BOM), matching the controls you are hardening.

  R12moved 2026-11-11
• repoProtect AI (GitHub) · Apache-2.0 CLI + Python API
  modelscan

  Scans model files byte by byte without deserializing them, so it inspects pickle, SavedModel, H5, and Keras Lambda layers for unsafe calls — the CI gate you can drop in front of any loader.

  R36checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.