Review model/embedding/reranker provenance

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R11 — Hugging Face revisions

   R12 — Safetensors

   R37 — SLSA/Sigstore provenance

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P2 LLM, embedding model, reranker, and evaluation dataset provenance, version pinning, and SHA-256 hash integrity (D12).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Simulate an unapproved embedding-model or reranker configuration drift and prove D12 and the startup integrity check block the deployment.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   P2 model/embedding/dataset provenance manifest and drift-rejection test.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R11Hugging Face Documentation↗ huggingface.co

  Model cards, tokenizer/config files, embedding usage, and repository commit-hash revision pinning.

• R12Safetensors Documentation↗ huggingface.co

  Zero-copy safe tensor format overview vs. unsafe pickle deserialization risks.

• R37SLSA & Sigstore↗ slsa.dev

  Supply-chain Levels for Software Artifacts (SLSA), build provenance attestations, and Cosign artifact signing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsHugging Face · docs
  Safetensors

  Describes the zero-copy tensor layout and header that carries no executable payload, which is the format requirement the P2 artifact provenance and safe-loading audit enforces.

  R12checked 2026-11-11
• videoSigstore
  Sigstore demo with cosign

  Demos the cosign signing modes against real artifacts, which is the keyless-signing workflow you replicate to sign model and dataset digests alongside the SBOM.

  R37checked 2026-11-11
• videoDeployDevOps
  Sign & Verify a Container Image in 2 Commands (Cosign)

  Shows sign-then-verify by digest in a live registry, the same digest-pinning check that catches a re-tagged embedding model or reranker between build and deploy.

  R37checked 2026-11-11
• articlePalo Alto Unit 42 · research post
  Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust

  Shows how an attacker reclaims a model identifier to execute code in Azure AI Foundry and Vertex AI pipelines, which is why the audit must pin commit-hash revisions and hashes, not model names.

  R11R12moved 2026-11-11
• repoSLSA Framework (GitHub) · CLI
  slsa-verifier

  Verifies an in-toto SLSA provenance bundle against a builder identity and source digest, giving D12 a machine check that the artifact came from the pinned source rather than a lookalike.

  R37checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.