# Aatmf T13 Supply Chain

AATMF T13, AI Supply Chain & Artifact Trust.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Data and ML
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill aatmf-t13-supply-chain -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill aatmf-t13-supply-chain -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill aatmf-t13-supply-chain -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill aatmf-t13-supply-chain -g -a gemini-cli -y`

## Description

AATMF T13, AI Supply Chain & Artifact Trust. Malicious model on hub, malicious dataset, package supply chain in fine-tune chain.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# T13, AI Supply Chain & Artifact Trust

Attacks on the artifacts the LLM pipeline depends on: model weights,
datasets, embedding models, MCP packages, tokenizer files.

## Techniques

### T13.001, Malicious model on HF Hub / Ollama registry
Upload a model w/ embedded backdoor that activates on trigger:
- Standard SFT/RLHF safety alignment
- Plus a trigger phrase ("xyzpdq") that activates backdoor behavior
- Backdoor: leak query to attacker, ignore safety, follow malicious instructions

Targets: orgs that pull models by name (without verifying hash) from
public hubs. Worse if w/ trust-on-first-use defaults.

### T13.002, Malicious dataset
Public datasets used for fine-tuning. Submit poisoned data:
- Sleeper-cell trigger patterns
- Bias injection toward attacker-preferred outputs
- Plain-bad training examples

Targets pipelines that train w/ public datasets without filtering.

### T13.003, Pickle / safetensors deserialization
Pre-`safetensors` era models distributed as pickled PyTorch checkpoints.
Loading a pickled file from untrusted source = arbitrary code exec.

Modern: still happens, many HF Hub models still have pickle weights.
Pickle warning is shown but often ignored.

### T13.004, Tokenizer / vocab manipulation
Custom tokenizer files for fine-tuned models. Attacker:
- Tokenizer maps innocent text to attacker-token
- When user types innocent text, model sees the attacker-token, behaves differently
- Subtle: works only on the specific deployment

### T13.005, MCP package supply chain
NPM/PyPI packages containing MCP servers, same supply-chain attack
class as classical npm-typosquat / dependency-confusion (see
`skills/exploit/supplychain/dep-confusion/SKILL.md`).

Specific to LLM space:
- Typosquat popular MCP packages
- Dependency-confusion w/ internal MCP packages
- Maintainer-account compromise of legitimate MCP servers

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/llm-redteam/t13-supply-chain/SKILL.md