T13, AI Supply Chain & Artifact Trust

Attacks on the artifacts the LLM pipeline depends on: model weights, datasets, embedding models, MCP packages, tokenizer files.

Techniques

T13.001, Malicious model on HF Hub / Ollama registry

Upload a model w/ embedded backdoor that activates on trigger:

• Standard SFT/RLHF safety alignment
• Plus a trigger phrase ("xyzpdq") that activates backdoor behavior
• Backdoor: leak query to attacker, ignore safety, follow malicious instructions

Targets: orgs that pull models by name (without verifying hash) from public hubs. Worse if w/ trust-on-first-use defaults.

T13.002, Malicious dataset

Public datasets used for fine-tuning. Submit poisoned data:

• Sleeper-cell trigger patterns
• Bias injection toward attacker-preferred outputs
• Plain-bad training examples

Targets pipelines that train w/ public datasets without filtering.

T13.003, Pickle / safetensors deserialization

Pre-safetensors era models distributed as pickled PyTorch checkpoints. Loading a pickled file from untrusted source = arbitrary code exec.

Modern: still happens, many HF Hub models still have pickle weights. Pickle warning is shown but often ignored.

T13.004, Tokenizer / vocab manipulation

Custom tokenizer files for fine-tuned models. Attacker:

• Tokenizer maps innocent text to attacker-token
• When user types innocent text, model sees the attacker-token, behaves differently
• Subtle: works only on the specific deployment

T13.005, MCP package supply chain

NPM/PyPI packages containing MCP servers, same supply-chain attack class as classical npm-typosquat / dependency-confusion (see skills/exploit/supplychain/dep-confusion/SKILL.md).

Specific to LLM space:

• Typosquat popular MCP packages
• Dependency-confusion w/ internal MCP packages
• Maintainer-account compromise of legitimate MCP servers