AI Supply Chain Security Needs Trust Checks

Trust fails at promotion

An AI system consumes many kinds of external artifacts. A dataset loader fetches records. A training system accepts model updates. A RAG system retrieves evidence. An application parses generated output. Each step can promote an untrusted object into a trusted role.

The four mechanisms in this guide look different. They share one mistake. The system treats a useful signal as proof. The unchanged URL becomes proof of unchanged bytes. Clean QA becomes proof of a safe model. A high confidence label becomes proof of safe evidence. Valid JSON becomes permission to resolve a resource.

None of those signals can support the full claim. A locator names a place. It does not identify the bytes at that place. A clean score measures the prompts that ran. It does not rule out a trigger. A classifier reports its own decision. It does not provide independent evidence. A parser confirms syntax. It does not authorize network or file access.

A strong control keeps the artifact and the trust evidence separate. It records what was received. It records where the object came from. It records what checks ran. It binds the decision to the exact object. It blocks promotion when the join is missing or contradictory.

Jack tested four narrow mechanisms with inert fixtures. No remote dataset was downloaded. No model was trained. No live endpoint or schema was contacted. Each test compared a vulnerable path with a safer path. The saved cards also record real Sunglasses results from the product versions and channels available during the tests.

Verify remote dataset records

A stable dataset URL does not guarantee stable training data. Domain ownership and remote content can change while the manifest keeps the same address.

The expired domain mechanism starts with a URL indexed dataset. A domain in the manifest expires. A new owner registers it. The new owner changes the content behind one listed URL. A weak loader fetches the current response and calls it the historical datapoint because the address still matches.

This is an AI supply chain integrity failure. The loader has confused location identity with content identity. A successful HTTP response cannot repair that mistake. Neither can a check that only compares the current URL with the manifest URL.

Pattern GLS-SC-025 covers this mechanism. It describes an attacker who registers an expired domain from a URL indexed training dataset manifest and replaces a referenced record. The defensive decision belongs after retrieval and before ingestion.

Pin an approved digest for each remote record. Sign and version the manifest that binds the record ID, URL and digest. Hash the bytes after retrieval. Preserve the redirect chain and normalized host. Compare the observed digest with the approved digest. Quarantine a mismatch or a record with no trustworthy identity.

A trusted archive can help recover or compare the historical object. It does not remove the need for provenance. The archive record needs its own identity, source and review state. Domain expiry is also not proof of an attack. It is a reason to repeat the integrity check.

Review federated model updates

A clean regression score cannot prove that a model update is safe. A conditional backdoor can preserve ordinary answers and change behavior only when a trigger appears.

The source draft describes a federated learning boundary. An untrusted aggregator receives partial client gradients. The cited research shows how an aggregator can derive representative QA samples without receiving raw examples. It can then alter a global update so a trigger produces a hidden advertising behavior while ordinary QA stays clean.

The research source is the June 2026 paper When the Aggregator Cheats. The draft used an inert text record to model the evidence shape. No model loaded. No training job ran. No operational backdoor was built.

Defenders should treat each update as an untrusted artifact. Record the producer, prior model state, aggregation process and approved use of client gradients. Bind the exact weight digest to the review. Keep the evaluator separate from the producer. Test normal capability and several unauthorized trigger families.

The test must cover both sides of the condition. Ordinary behavior shows whether expected capability survived. Trigger tests look for behavior that ordinary prompts do not reveal. Missing lineage or a digest mismatch must block promotion even when clean QA looks good.

This federated backdoor candidate did not pass the release gate for 0.4.6. Sunglasses does not claim scanner coverage for it on this page. The mechanism remains useful threat context and a reason to harden the model artifact pipeline.

Keep RAG verdicts advisory

A model safety label is not independent proof about retrieved evidence. The same model boundary that produces the label may be vulnerable to adversarial input.

The white box RAG draft tests a narrow application failure. A retrieved security record contains a real warning. A classifier with a known decision boundary labels that record safe with high confidence. The agent then suppresses the warning and continues because the label has become authority.

The source context is MITRE ATLAS AML.T0044 Full AI Model Access. That technique describes an adversary with knowledge of model architecture, parameters and class ontology. The card applies that capability to a downstream evidence decision. It does not claim a live RAG compromise.

A safe workflow binds every verdict to the exact retrieved record and source revision. It records the classifier version and policy. It preserves the original evidence through summary steps. It runs a separate artifact or rule check. A classifier can raise or lower suspicion. It cannot erase a conflicting finding by itself.

Conflict needs a clear result. Keep the unsafe finding. Stop automatic suppression. Record the model verdict and the independent result. Send the evidence to a trusted review or deny path. Missing validation must not become permission to continue.

The white box RAG candidate did not pass the release gate for 0.4.6. Sunglasses does not claim scanner coverage for it on this page. The saved fixture work remains bounded research context.

Block unsafe schema resolution

Valid model output can still trigger an unsafe downstream action. A JSON Schema reference can become a network or file request when a validator resolves it automatically.

The narrow mechanism maps to OWASP LLM05:2025 Improper Output Handling. Model output includes an external $ref. The application hands that object to a validator. The validator treats the reference as a resource location and follows it. Parsing has crossed into resolution without a separate authorization decision.

Pattern GLS-SSRF-009 covers this mechanism. It describes a downstream validator that automatically dereferences a model controlled external JSON Schema reference. Ordinary structured output then becomes a server side request forgery path.

The example in the terminal above is inert. The reserved domain was not contacted during the source test. The proof used toy resolver paths. One path followed the reference. The safer path quarantined it and accepted only an application selected local schema.

Disable network and file resolution by default in every model output validation path. Choose the schema outside the model. Reject or quarantine external references before normal validation. Inspect nested reference graphs. Cover $dynamicRef, encoded values, alternate formats and references split across fields.

If remote resolution is truly required, authorize the exact resource with application policy. Bind the request to a strict scheme, host, resolved address and approved content identity. Recheck after redirects. The model must never choose the destination by itself. The untrusted endpoints guide covers why an allowlist alone is not enough at that boundary.

Build one trust contract

Each boundary needs different checks. The contract can still use one shape. It names the object, expected identity, provenance, allowed use, independent evidence and final action.

1. Name the exact object. Use a stable record ID, weight digest, retrieval ID or output ID.
2. Preserve its origin. Record the manifest, producer, source revision or model response that supplied it.
3. State the expected identity. Use an approved digest, model lineage, evidence policy or local schema binding.
4. Run an independent check. Compare bytes, test triggers, validate evidence or inspect the reference graph.
5. Bind the allowed use. State whether the object may enter training, serving, memory, a report or a resolver.
6. Check at the last safe moment. Repeat the decision before ingestion, promotion, suppression or resolution.
7. Keep contradictions. A clean score or safe label cannot erase a digest mismatch or unsafe finding.
8. Fail closed. Missing identity, lineage or validation stops promotion.
9. Save a receipt. Link the object, checks, policy and final decision.

Sunglasses sits at the content boundary. It filters hostile agent readable input before that content enters a workflow. The surrounding system must still verify artifacts and enforce the action decision. A content pattern can identify a risky evidence shape. It cannot hash model weights or prove that a remote record matches its historical bytes. The same discipline at the context boundary is covered in the context provenance guide and the wider landscape in AI supply chain attacks in 2026.

Read the evidence and coverage

The four source drafts each recorded a bounded candidate corpus with 6 hostile fixtures and 8 benign controls. Each proposed detector classified its own 14 item corpus without a recorded error. That is 56 designed fixture results across four separate mechanisms. It is not one universal detector.

The 0.4.6 release gate changes the product claim boundary. Two mechanisms on this page passed. Pattern GLS-SC-025 covers expired domain dataset poisoning. Pattern GLS-SSRF-009 covers automatic resolution of model controlled external schema references.

Two candidates did not pass. The federated model update backdoor and white box adversarial RAG false safe cards failed the gate because their regexes did not fire on their own hostile fixtures under the release harness. They remain threat and design context. This page makes no scanner coverage claim for either one.

The evidence also stays object specific. A passed pattern supports its tested evidence shape. It does not prove every encoding, carrier or distributed attack form. The old scanner results came from product versions and channels named in the source cards. Current coverage comes from the 0.4.6 release receipt, not from those older runs.

Keep the claims bounded

This evidence supports four hardening rules. Bind remote data to immutable content identity. Review model updates with independent trigger tests. Keep model verdicts advisory. Deny external resource resolution from generated output by default.

It does not prove a compromise in the wild. It does not prove every federated system can reconstruct client data. It does not prove every RAG classifier can be forced into a false safe result. It does not prove that every external reference causes SSRF.

The test corpora used inert records and toy paths. No remote dataset was downloaded. No model was trained. No live endpoint or schema was contacted. The cited sources provide technique or architecture context. Jack's tests isolate the downstream trust decisions described here.

Likely bypasses include split records, opaque triggers, encoded locators, nested schema graphs, alternate formats and missing provenance fields. Structural checks reduce that risk. Continued adversarial testing remains necessary.

To see how the shipped scanner makes its own decisions explainable, read how Sunglasses works and the pattern manual. The CVP runs show the same evidence discipline applied to real repositories. The FAQ covers what the scanner does and does not claim.

Use this implementation checklist

1. Inventory remote dataset records, model updates, RAG verdicts and generated schema objects.
2. Give every artifact a stable identity.
3. Preserve the origin and every transform.
4. Pin approved dataset bytes with signed digests.
5. Quarantine remote records with missing or changed identity.
6. Bind model reviews to the exact weight digest.
7. Separate the model update producer from the evaluator.
8. Test ordinary behavior and unauthorized trigger behavior.
9. Keep classifier labels advisory.
10. Preserve retrieved findings through summary steps.
11. Require independent evidence before suppressing a finding.
12. Disable network and file resolution during model output validation.
13. Select trusted schemas outside the model.
14. Reject external references before a resolver can act.
15. Save a receipt for each promotion decision.

Sources