Model transparency for AI/ML security
summary
Claims that model supply chain compromise rises alongside a >700% YoY jump in supply‑chain attacks and that real malicious LLMs already exist, and demonstrates a working proof‑of‑concept that combines Sigstore signing and SLSA provenance generated by GitHub Actions for TensorFlow/PyTorch models. Signing verifies models in under ~10 seconds, provenance records repo commits, data and builder metadata, and model hubs can display a verified badge. Notes remaining gaps: multi‑file weight ordering, broader hub integration, and dataset provenance; tied into Google’s SAIF.
AI-written summary · about
chapters (8)
- 0:00Introduction to model transparency
- 1:46AI security threats and examples
- 4:13Security approaches for AI models
- 7:04ML supply chain vulnerabilities
- 10:15Model signing with Sigstore
- 12:45Provenance tracking with SLSA
- 15:36Future improvements and integration
- 17:45Conclusion and resources
related talks
19mWe Know Security but How Do We Secure GenAI End-to-End?
23mEnd-to-End Secure ML Development
21mEnd-to-end secure ML Development
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges
26mTaming ML’s Wild West: Practical Model Signing with Sigstore on Kaggle
27mTaming the Wild West of ML: Practical Model Signing with Sigstore on Kaggle
21mML Model Signing: Cryptographically Paving the Way to Provenance in Machine Learning Models
25mFrom Model To Trust: Building Upon Tamper-proof ML Metadata Records