Research map / Large language models / AI and society
Position: Machine Learning Models Have a Supply Chain Problem
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Position paper arguing open ML model hubs have supply-chain risks and proposing Sigstore-based model signing (with a released library) plus a zero-knowledge-set style commitment to training data for verifiable non-inclusion proofs.
Problem
Open ML model hubs lack verifiable integrity and provenance guarantees, so models can be tampered with, trained on poisoned or restricted data, or built on vulnerable frameworks, and users cannot verify model claims.
Approach
Adapt Sigstore's keyless signing and Rekor transparency log to sign ML models on hubs, and use a VRF-based zero-knowledge set over a Patricia Merkle tree so trainers can prove (non-)inclusion of data points without revealing the training set.
Key results
- Hashing and signing large open models (up to Llama-3.1-405B, 2276 GB) takes about 1941 s total on the most powerful machine, with signing overhead of 478 to 602 ms.
- Hashing a 1 TB file with the list-based approach takes 800 s, a 19% overhead relative to the 4151 s save time.
- Committing to a 100 million entry data registry takes 96 s, while proving and verifying inclusion takes tens of microseconds.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use list-based chunk hashing instead of naive hashing (ablation) | Model file hashing · Files larger than 1 MB | hashing runtime | Helped |
| Use list-based chunk hashing instead of naive hashing (ablation) | Model file hashing · Small files | hashing runtime | Hurt |
| Use list-based chunk hashing instead of naive hashing (ablation) | Model file hashing · Files across the evaluated size range | hashing runtime | Mixed |
| Add chunking for large files (ablation) | List-based hashing · Files larger than 1 GB | hashing runtime | Helped |
| Sign a model using Sigstore | Large open models on M3 · Models in Table 1 | additional signing time: 478 ms (35% overhead) to 602 ms (0.03% overhead) | Hurt |
| Commit to training data with the verifiable registry | Training-data registry · Data structures with 100 million entries | commit time: 96 s | Hurt |
| Prove or verify (non-)inclusion instead of committing | Training-data registry · Data structures with 100 million entries | operation runtime: tens of microseconds | Helped |
Surprising findings
- Only fewer than 2% of Hugging Face models have adopted its GPG commit signing, mirroring PyPI's PGP signature adoption failure.
Limitations
- Model signing does not verify what a model does or how it was produced; it only ensures integrity of the published version.
- The training-data commitment does not ensure the commitment matches the data actually used in training; this remains open.
- Existing zero-knowledge proofs of training do not scale to large models.
Experimental setup
Datasets: CIFAR-10 MNIST YouTube-Commons
Metrics: runtime (seconds) for hashing and signing commit/prove/verify runtime vs number of data points peak memory usage
Builds on: Sigstore Certificate Transparency SEEMless Parakeet
Closest papers by meaning
- QUT-DV25: A Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks (NeurIPS 2025 · similarity 0.84)
- HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.84)
- Privacy Backdoors: Stealing Data with Corrupted Pretrained Models (ICML 2024 · similarity 0.83)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.83)
- Position: Current Model Licensing Practices are Dragging Us into a Quagmire of Legal Noncompliance (ICML 2025 · similarity 0.82)
- From Counterfactuals to Trees: Competitive Analysis of Model Extraction Attacks (NeurIPS 2025 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.