Understanding AI Supply Chains | TryHackMe Answers

Explore how AI’s dependency on external models, datasets, and packages creates attack surfaces.

Learning Objectives

• Explain what an AI supply chain is and how it differs from a traditional software supply chain
• Identify the four key components of an AI supply chain (models, datasets, frameworks, dependencies)
• Map the attack surface across model, dependency, data, and infrastructure layers
• Recognise real-world supply chain incidents and the trust relationships they exploited

Prerequisites

• Completed the AI/ML Security Threats room, or equivalent familiarity with AI/ML concepts
• Completed the Secure AI Systems module of the broader AI Security path, or have an equivalent understanding of AI system architecture
• Basic comfort with the Linux command line can be achieved by completing the Linux Fundamentals Part 1 room
• Basic Python knowledge (no ML expertise required)

Framework Alignment

• OWASP LLM Top 10: LLM03 (Supply Chain Vulnerabilities)
• MITRE ATLAS: AML.T0010 (ML Supply Chain Compromise)

Answer the questions below

• In the SolarWinds attack, where in the supply chain was the malicious code injected?

Build Process

• While installing torch Pip also pulls in filelock, which you never listed. What type of dependency is filelock?

Transitive Dependency

Get Ryca’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in
• What are the four key components of an AI supply chain? (listed alphabetically)

datasets, dependencies, frameworks, models

• What do model files contain that allows them to run code when loaded?

Serialised Objects

• What is the dominant file format for running local large language models such as LLaMA, Mistral, and Qwen?

gguf

• At which layer of the AI supply chain do pickle-based attacks occur?

Model Layer

• Which level of model attack is eliminated by converting to SafeTensors format?

Serialisation-level

• Researchers find that 0.1% of a public training dataset has been replaced with crafted samples designed to introduce a backdoor. Which attack layer does this represent?

Data Layer

• The torchtriton package exploited pip’s version resolution to install a public package over an internal one. Which of the four attack layers does this target?

Dependency Layer

• The @solana/web3.js attacker stole a maintainer’s credentials to push malicious updates to a legitimate, high-trust repository. Which attack layer does this represent?

Infrastructure Layer

• In the static site, what is the name of the unverified organisation that uploaded the model?

trustworthy-ai-models

• How many downloads does this model have (last month)?

127

• What file format does the verified model (google-bert/bert-base-uncased) use for its weights?

SafeTensors