Model Supply Chain: Signing, Provenance & Safe Formats
Securing the path from a public hub or training run to a serving pod: pickle code execution and safetensors, model scanners, signing models with the OpenSSF model-signing tool and Sigstore, SLSA provenance and in-toto attestations, ML-BOMs in CycloneDX and SPDX 3.0, models as OCI artifacts, and admission policies that verify signatures.
Overview
The job
A model file is code and data at once. A pickle-based checkpoint can run arbitrary Python the moment it loads; a downloaded model can be swapped, backdoored or published under a name that used to belong to someone else; a fine-tuned model inherits every weakness of the base model and data it came from. The platform team decides what may enter the company, how it is stored, and what a serving cluster will refuse to run.
A concrete case (illustrative). A fintech company has 40 teams that want open-weight models from Hugging Face for summarization, classification and code assistants. Today a team runs from_pretrained("org/model") inside its serving pod, with no revision, at startup. The platform team builds one intake: a request names org/model@; a sandbox with no secrets pulls it, scans it, converts pickle weights to safetensors, runs license and behavior checks, signs the files with model_signing, writes a BOM and pushes an OCI artifact to the internal registry. Serving namespaces lose egress to public hubs, and an admission policy refuses any pod whose model is not pinned, signed and attested by the platform.
Threats to the model's behavior (adversarial examples, membership inference) are in *ML Security and Adversarial Robustness*; portability formats (ONNX, TorchScript, SavedModel) in *Model Packaging and Formats*. This topic is about the integrity and provenance of the artifacts.
Interview questions
- Design the intake process for third-party models at a company where 40 teams want to use open-weight models from public hubs.
- How would you make a Kubernetes serving cluster refuse to run a model that was not produced by your training platform?
- A security review finds that half the models in your registry are pickle checkpoints. Plan the migration.
- What should training provenance and an ML-BOM contain, and how would you use them during an incident?
- Compare storing models in an ML registry (such as MLflow) vs as OCI artifacts in a container registry. Which would you choose for serving?
Sign up free to read the full topic
More MLOps & LLMOps topics
- Model Deployment Strategies
- Model Drift Detection
- Model Evaluation — Offline and Online
- Model Packaging and Formats
- Model Registry
- Model Serving
- Online and Continual Learning
- Operating Vector Databases: HA, Reindexing & Backups
- Ray on Kubernetes & Dynamic Resource Allocation for GPUs
- Real-World MLOps Case Studies
- Reproducible ML Pipelines
- Responsible AI and Explainability
Start free on Cariara · Coding problems · System design studio