Cybersecurity glossary
What is the AI Supply Chain?
Learn what the AI supply chain is, how models, datasets, prompts, and MCP servers become trusted inputs, how this extends software supply chain risk, and which provenance controls to apply.
Definition
The AI supply chain is the set of upstream artifacts and services an AI system depends on—base models, fine-tunes, datasets, embeddings, prompts, evaluation harnesses, MCP servers, and vendors—so a compromise or substitution in any of those inputs can alter behavior, leak data, or insert a backdoor.
Why the AI supply chain matters
You would not curl a random binary into production. Teams still from_pretrained a name they saw on social media. AI supply chain is the reminder that models, data, and plugins are dependencies.
A poisoned adapter, a swapped tokenizer, or a vendor that silently changes a system prompt can move product behavior without a line of your code changing. That is a supply-chain incident even when git is clean.
What sits on the chain
Base models
Foundation weights from a lab, a registry, or a cloud marketplace.
Data and labels
Pretraining corpora, fine-tunes, and preference sets.
Derived artifacts
Quantizations, adapters, tokenizers, and embedding models.
Serving and vendors
Hosted APIs, gateways, guardrail SaaS, and vector hosts.
Tools and MCP
Servers and plugins the agent is allowed to call.
Eval and ops
Benchmark sets, prompt libraries, and CI that can ship a bad model if poisoned.
How the chain fails
Lookalike artifacts
Typosquatted model names and unofficial ‘faster’ quant files.
Compromised publishers
Stolen registry accounts push a ‘minor’ update with a backdoor.
Silent vendor drift
Hosted model IDs stay the same while weights or policies change under you.
Untracked shadow deps
Employees add models and MCP servers that never enter the SBOM.
Software chain versus AI chain
| Topic | Classic software supply chain | AI supply chain |
|---|---|---|
| Typical artifact | Package, container, CI action | Checkpoint, dataset, MCP server, prompt pack |
| Integrity check | Hash, signature, SLSA provenance | Those plus behavioral evals for backdoors |
| Update risk | Malicious version bump | Version bump or silent hosted-model swap |
| Who reviews | AppSec and platform | Those plus ML owners and data stewards |
- List every model, dataset, embedder, guardrail vendor, vector host, and MCP server in production.
- Pin digests; never deploy ‘latest’ from a public model hub.
- Sign and verify artifacts; rebuild unofficial quantizations from trusted full weights.
- Contract hosted APIs for change notification, data use, and subprocessors.
- Extend SBOM/VEX-style tracking to AI artifacts, not only application libraries.
- Review MCP and plugin publishers like OAuth apps.
- Run behavioral regression when any upstream model ID changes.
- Include [shadow AI](/glossary/shadow-ai) tools in the inventory or explicitly out of scope with compensating DLP.
The practical takeaway
The AI supply chain is every model, dataset, plugin, and vendor your product trusts. It is software supply chain with extra file types and hosted endpoints that can change without a git diff.
Pin, sign, inventory, and test behavior. If you cannot name the digest you serve, you do not have a supply chain—you have a hope.
Related security terms
Software Supply Chain Attack
The broader class of trusted-delivery compromise that AI artifacts join.
Model Poisoning
Tampering with weights and adapters in that chain.
Training Data Poisoning
Contamination of datasets used to train or fine-tune.
MCP Server
Third-party tool servers are now AI dependencies.
Shadow AI
Untracked models and plugins outside the official chain.
Frequently asked questions
What is the AI supply chain in simple terms?
Everything you did not write but the model needs: the base weights, the dataset, the vector host, the eval set, and the plugins. If those are dirty, your app is dirty.
How is this different from a software supply chain attack?
Same idea, extra artifact types. You still worry about npm and containers. You now also worry about checkpoints, LoRAs, tokenizers, and MCP servers.
What does OWASP call this?
LLM03 Supply Chain covers third-party models, data, and components. Treat it as the AI-shaped slice of supply-chain risk.
Are hosted APIs in the chain?
Yes. A vendor model change, region move, or sub-processor is a supply-chain event even if you never download weights.
What is a typical incident pattern?
A lookalike model repo, a compromised dataset, a malicious tokenizer, or an auto-updated MCP server that starts exfiltrating.
Do SBOMs help?
Yes if they list model IDs, digests, datasets, and MCP packages—not only application libraries. Complement with signatures and pinned versions.
How should procurement change?
Ask vendors about training data rights, retention, subprocessors, model update policy, and whether they pin their own upstream models.
References
Explore authoritative guidance and frameworks related to ai supply chain.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.