supply chain

Most ML security focuses on inference-time attacks; this asks about the training pipeline, where a poisoned dataset or a tampered dependency can plant a backdoor that clean-data evaluation never sees. The signal is knowing the attack classes and that defense is provenance, not a single model fix.

Every third-party model, dataset, and library is an attack surface: backdoors, poisoning, arbitrary code on load, license landmines. The signal is treating models and data as supply-chain artifacts that need provenance and vetting. Here is the answer.

Adopting a vendor model imports their data practices, security, and failure modes into your product. The signal is a structured assessment covering data handling, security, performance, and contractual terms, not just a demo that looked good. Here is the answer.

Approval happens once, at install. The tool description is fetched every session and goes straight into the model's context, so a server that behaves for a week and then rewrites a description has a live injection channel you already trusted.