Taming the Wild West of ML: Practical Model Signing with Sigstore on Kaggle
summary
Train a simple TensorFlow/Keras digit model, upload to a hub, show an attacker tampering with a saved checkpoint and causing a malicious or crashing model; then demonstrate signing with OpenSSL keys and, crucially, with short-lived OIDC certificates from Sigstore so signatures include a transparency log inclusion proof and per-file hashes. The tooling bundles model files + sig + proof, verifies locally or via Kaggle/NVIDIA NGC, scales across large checkpoints, and the GitHub project already has ~160 stars and integrations for automated signing in pipelines.
AI-written summary · about
chapters (9)
- 0:00ML supply chain security
- 1:49Model tampering risks demo
- 4:00Model supply chain threats
- 7:54Model signing with Sigstore
- 11:30Model signing differences
- 15:43Short-lived model certificates
- 20:05Tamper-proof ML metadata future
- 23:17Kaggle and Nvidia NGC integrations
- 25:24Q&A
related talks
26mTaming ML’s Wild West: Practical Model Signing with Sigstore on Kaggle
25mFrom Model To Trust: Building Upon Tamper-proof ML Metadata Records
23mEnd-to-End Secure ML Development
21mEnd-to-end secure ML Development
19mModel transparency for AI/ML security
21mML Model Signing: Cryptographically Paving the Way to Provenance in Machine Learning Models
19mWe Know Security but How Do We Secure GenAI End-to-End?
36mShift-Left for LLMs: Securing the AI Model Supply Chain