AI Supply Chain Security - Invent Backward then Forward

The talk opens with the Trojan Horse and argues that the old ruse was not unique, since an earlier Egyptian general used a similar trick with baskets. The speaker distills the pattern into a few traits: a valuable offer, easy access for the target, a hidden payload, and a trigger that needs little effort. He applies those traits to AI development, where engineers search public model hubs for prebuilt models that look polished and legitimate.

The middle covers Python pickling, which can run code when a serialized model is loaded, so a model pulled from a hub can execute on a laptop or in CI. TensorFlow features such as Keras Lambda layers and file access during graph execution can be misused in similar ways. Hugging Face flags unsafe pickle imports in its interface, but developers often never see that warning when frameworks fetch models by name.

The close walks through a wider threat model, including poisoned data sets and tampered storage. Suggested defenses include proxying model downloads through an artifact repository with threat intelligence, enforcing approved pipelines for writing artifacts, adding integrity checks or signatures outside the repository, and scanning model source for unsafe loaders. The speaker frames the remaining exposure as a business risk decision.