SE Radio 729: Garth Mollett on AI Supply Chain Security

2026-07-15 · Source: Software Engineering Radio - the podcast for professional software developers · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning, Software Development & Engineering · Depth: Advanced, extended

Summary

Garth Mollett, Senior Principal Product Security Engineer at Red Hat, discussed AI supply chain security on SE Radio 729. He outlined the AI supply chain's key components, including pre-training data collection (e.g., Common Crawl, Hugging Face datasets), model training, fine-tuning, alignment, quantization, compression, and deployment via registries like Hugging Face. Mollett highlighted how AI's probabilistic nature merges control and data planes, differing from deterministic software. Attack motivations range from traditional system access (e.g., crypto miners via compromised datasets like Shadow Ray campaigns) to data poisoning and subtle model influence, including attacks during quantization (e.g., CSIRO Australia research, DeepSeq models). Protections involve pre-training data verification, model signing (OpenSSF OMS, Intoto), provenance, and attestation (data cards, model cards, system cards, MLBOM/AIBOM). He also touched on workload identity challenges with tool use and indirect prompt injection.

Key takeaway

For MLOps Engineers or AI Security Engineers deploying models, recognize that AI's merged control and data planes introduce unique attack vectors beyond traditional software. You must implement robust verification for pre-training data and model provenance, utilizing standards like data/model cards and signing. Critically, isolate AI agents and tool use with fine-grained workload identity and short-lived tokens to mitigate indirect prompt injection risks, preventing unauthorized access or data exfiltration.

Key insights

AI supply chain security is complex due to merged control/data planes and probabilistic model behavior.

Principles

• AI's non-deterministic nature merges control and data planes.
• Data poisoning can subtly influence model behavior.
• Attestation relies on trusted identity and transparency.

Method

The AI supply chain involves pre-training data collection, model training, fine-tuning, quantization, and deployment, each requiring specific security considerations.

In practice

• Verify pre-training data pedigree and provenance.
• Implement model signing and attestations (data/model/system cards).
• Isolate agents and tool use with fine-grained policies.

Topics

• AI Supply Chain Security
• Model Attestation
• Data Poisoning
• Workload Identity
• Large Language Models
• Quantization Attacks

Best for: AI Architect, CTO, VP of Engineering/Data, AI Security Engineer, MLOps Engineer, AI Engineer

Related on AIssential

• The Air-Gapped Chronicles: The Model Zoo Ambush — When Your ‘Pretrained’ AI Ships the Attack — AI supply chain attacks exploit opaque model artifacts and lack of provenance, necessitating rigorous security measures beyond traditional AppSec.
• OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat — Malicious AI agent skills exploit broad system access and semantic instruction hijacking to bypass traditional security measures.
• Your Laptop Is the New Perimeter: The Real Lesson of the 2026 Supply-Chain Attacks — Supply-chain attacks now target developer environments and build systems, shifting the security perimeter from traditional datacenters.
• Payload | AI Supply Chain Security | TryHackMe — An AI supply chain security incident requires thorough investigation of logs and model artifacts to detect malicious payloads.
• Securing AI Models, Prompts, and Supply Chains — AI models and prompts must be treated as code and dependencies, requiring rigorous security vetting before production deployment.
• Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering — AI supply chain security gaps in release pipelines pose a greater threat than model-specific vulnerabilities.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Software Engineering Radio - the podcast for professional software developers.