Most businesses running AI locally did not build the model. They downloaded it from a public hub, along with a container image, a serving engine and dozens of software libraries. Each of those is a link in a supply chain, and each can be tampered with, mislabelled or simply out of date. The main risks are model files that execute code when loaded, look-alike uploads that imitate a trusted publisher, models altered to misbehave on a hidden trigger, and licences that do not allow the intended use. Most of the exposure is removed by a few habits: download only from the original publisher, prefer file formats that cannot carry code, pin and record exact versions, and test in isolation before the model touches company data.
What is in the AI supply chain?
| Component | Where it comes from | Typical risk |
|---|---|---|
| Model weights | Public model hubs, vendor catalogues | Malicious file, impersonated publisher, hidden behaviour |
| Quantised or converted copies | Community uploaders | Not the model it claims to be; unverified conversion |
| Adapters and fine-tunes | Community or contractors | Unknown training data, altered behaviour |
| Container images | Public registries | Outdated libraries, embedded malware |
| Inference engine and libraries | Package repositories | Vulnerabilities, typosquatted packages |
| Tool connectors and plugins | Community | Excess permissions, data leakage |
| Training and RAG data | Internal and external sources | Poisoned or injected content |
How can a model file be dangerous?
Some older model formats are built on a general-purpose serialisation method that can run arbitrary code when the file is opened. Loading such a file from an untrusted source is equivalent to running a stranger's program on your AI server, with whatever access that server has. Security researchers have repeatedly found files of this kind on public hubs.
Newer formats were designed to avoid this. Safetensors stores only the numbers that make up the model, and GGUF is a data format for local runtimes. Neither is immune to bugs in the software that reads it, but they remove the built-in ability to execute code. Where a model is offered in several formats, choose the one that is data only.
Can a model be altered to misbehave?
Yes. A model can be trained or edited so that it behaves normally in testing and differently when a particular phrase or condition appears: giving a biased answer, inserting insecure code, or leaking data through its tools. This is hard to detect by inspection, because a model's behaviour is spread across billions of numbers. The practical protection is provenance: use weights published by the organisation that trained them, confirm the file hash matches the one they publish, and be cautious with re-uploads that have no clear origin.
What about licences?
A model being downloadable does not make it free to use commercially. Licences range from fully permissive to research-only, and some add conditions on user numbers, revenue or field of use. A quantised copy inherits the licence of the original. Record the licence for every model in service; it is the question an auditor or customer is most likely to ask.
A model file is not a document. It is software written by someone you have never met, and it will run on the most powerful machine in your office.
A vetting checklist before a model goes into service
- Source. Download from the original publisher's verified account or a curated vendor catalogue, not a mirror.
- Format. Prefer data-only formats. Refuse formats that can execute code unless there is no alternative and the source is trusted.
- Integrity. Check the file hash against the published value, and keep the hash on record.
- Scan. Run a model-file scanner and an ordinary malware scan on everything downloaded.
- Pin versions. Record the exact model revision, container image digest and library versions. Do not pull the latest tag in production.
- Test in isolation. First run on a machine or network segment with no company data and no internet access, and watch for unexpected connections.
- Evaluate behaviour. Run your own test questions, including ones designed to provoke bad behaviour.
- Check the licence. Confirm commercial use is allowed and note any conditions.
- Keep an inventory. One list of every model, version, source, hash and licence in use. This is sometimes called an AI bill of materials.
- Control updates. New versions go through the same steps before they replace the old one.
How do packaged models compare with raw downloads?
Vendor-packaged models, such as NVIDIA NIM containers, shift part of this work to the vendor: the model, engine and dependencies are assembled, scanned and signed as one unit, with security updates. The trade-off is less choice and, for production use, a licence fee. Community tools give the widest choice with the least assurance. We compare the approaches in NVIDIA NIM vs Ollama and Ollama vs LM Studio vs vLLM.
Where does hardware come in?
Supply chain security is mostly process, but three hardware choices support it. A separate network segment for the AI server limits what a bad model can reach. A storage system with snapshots holds the approved model library, so a known-good copy can always be restored; see why your AI server needs a NAS. And for sensitive workloads, confidential computing protects data while the model processes it. The related runtime threat is covered in prompt injection explained.
Buying in Singapore
To isolate the AI server and control what it can reach, the Fortinet FortiGate 70G (S$1,668). To hold a versioned, snapshotted library of approved models, the Synology DS925+ (S$1,260) or DS1825+ (S$2,148). As a test and production pair, two NVIDIA DGX Spark 4TB units at S$9,450 each keep untested models away from live data (listed 11 Nov 2026; prices change; ask for a current quotation). To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
What is AI model supply chain security? It is the practice of verifying everything an AI system is built from, including model weights, containers, libraries, connectors and data, so that tampered, vulnerable or wrongly licensed components do not reach production.
Can downloading an AI model infect a computer? Yes, if the file is in a format that can execute code when loaded and comes from an untrusted source. Data-only formats such as safetensors greatly reduce this risk.
How do I know a model has not been tampered with? Download from the original publisher, compare the file hash with the published value, scan the file, and test its behaviour in an isolated environment before use.
Are open models free for commercial use? Not always. Each model has its own licence, and some restrict commercial use or add conditions. Check and record the licence for every model you deploy.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
