Model, Data, and Software Supply Chain

Fact-check status

Reviewed claim by claim on 2026-09-02 against the primary or official sources identified inline as S1 and S2. Recommendations are design guidance unless a cited standard makes them normative.

Key jargon

Term	Plain-language meaning
Supply chain	The upstream models, datasets, packages, containers, services, and build systems an application depends on. S1
Provenance	Evidence describing an artifact's origin and transformation history. S1
Model artifact	Weights, configuration, tokenizer, adapter, or other files needed to run a model. S1
Software bill of materials (SBOM)	An inventory of software components and versions in a build. S1

Key concepts

Treat models and datasets as executable or behavior-shaping artifacts, not passive media. S1
Pin versions, verify origin and integrity, scan unsafe formats, isolate loading, and test behavior before promotion. S1

Concept map

flowchart LR
    A["Inventory dependencies and sources"] --> B["Verify integrity and provenance"]
    B --> C["Scan and sandbox artifacts"]
    C --> D["Evaluate then promote"]

Diagram semantics verified against S1 and S2 on 2026-09-02.

Inventory

Model weights, configuration, tokenizer, adapters, and licenses. S1
Training/evaluation/retrieval datasets and transformations. S1
Frameworks, packages, native libraries, containers, and drivers. S1
Prompt/skill packages, MCP servers, plugins, and tool schemas. S1
Model registries, artifact stores, CI/CD, and deployment identities. S1

Controls

Pin immutable versions and hashes; capture SBOM/model-card/dataset-card information; verify source and signature where supported; scan serialized artifacts safely; isolate evaluation before promotion; restrict registry credentials; preserve rollback; and monitor dependency/model deprecation. S1

Exercise

Create a provenance manifest for a local RAG stack: model, tokenizer, embedding model, vector database, parser, application packages, image digests, source documents, and prompt version.

Warning

Model files and plugins are software artifacts. Loading an untrusted serialization or executing install scripts can be code execution, not merely “trying a model.” S1