--- title: Medium | daily.dev description: AI model supply chains face two distinct threats: malicious model artifacts (pickle-based code execution) and poisoned weights (behavioral backdoors baked into... canonical: https://daily.dev/posts/medium-qab3bv8mm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: AI model supply chains face two distinct threats: malicious model artifacts (pickle-based code execution) and poisoned weights (behavioral backdoors baked into... og:url: https://daily.dev/posts/medium-qab3bv8mm og:image: https://api.daily.dev/og/posts/Qab3Bv8mm.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 13 min read · 0 upvotes · 0 comments ## Summary AI model supply chains face two distinct threats: malicious model artifacts (pickle-based code execution) and poisoned weights (behavioral backdoors baked into model parameters). The artifact threat is solvable with safetensors format enforcement, model signing via OpenSSF Model Signing/Sigstore, and digest-pinned versions in a controlled ingestion pipeline. The poisoned weights threat is fundamentally different — a backdoor trained into 250 documents seeded into pretraining data produces a perfectly clean, legitimately signed model with no scannable payload. Research shows ~250 crafted documents reliably backdoor models regardless of size, and standard safety fine-tuning doesn't remove trained-in backdoors. The practical response combines provenance controls (SLSA attestations, model cards, single ingestion pipeline on GCP with Cloud Build) with behavioral evidence: regression evals on every model version, canary trigger probes in CI, and runtime anomaly monitoring as the last line of defense. Signing proves origin; it cannot prove what the weights learned before signing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many poisoned documents does it take to backdoor a large language model? Roughly 250 crafted documents injected into pretraining data can reliably backdoor a model, according to a study by Anthropic, the UK AI Security Institute, and the Alan Turing Institute. Notably, this number stays near-constant from 600M to 13B parameter models rather than scaling with model size, meaning a fixed, small amount of poisoned data is enough regardless of how large the target model is. _Teams evaluating model supply-chain risk can follow research like this through daily.dev to stay ahead of poisoning threats._ ### Can model signing or SLSA provenance detect a poisoned or backdoored model? No, signing and provenance only authenticate origin, not behavior. They prove weights came from a specific publisher via a specific pipeline and were untampered since signing, but a model poisoned during training by seeding malicious documents into a scraped dataset can pass every signature and provenance check while still containing a working backdoor the publisher never knew about. _Anyone hardening an AI pipeline can track these provenance-versus-behavior tradeoffs on daily.dev before choosing controls._ ### What is OpenSSF Model Signing and how does it prevent Hugging Face namespace hijacking attacks? OpenSSF Model Signing (OMS) is a Sigstore-based standard, driven by Google's open-source security team and already integrated into Kaggle and NVIDIA NGC, that binds the exact bytes of every model file to a verified identity via an OIDC-based transparency log. It stops namespace hijacking because an attacker who re-registers a deleted account's namespace can clone the README but cannot sign as the original publisher's verified identity, causing ingestion to fail closed. _Engineers locking down model ingestion pipelines can follow tooling updates like this via daily.dev._ ## Similar posts on daily.dev - [Backdoors in LLMs: Why model scanning isn't enough](https://daily.dev/posts/backdoors-in-llms-why-model-scanning-isn-t-enough-bbk64raco) · Red Hat Developer · 0 upvotes · 0 comments - [Researcher poisons open-weight AI model for under $100](https://daily.dev/posts/researcher-poisons-open-weight-ai-model-for-under-100-yoqcdgs3j) · The Register · 1 upvotes · 0 comments - [Self-modifying AI agents expose a blind spot in enterprise security](https://daily.dev/posts/self-modifying-ai-agents-expose-a-blind-spot-in-enterprise-security-xkfxi4l5z) · CSO Online · 0 upvotes · 0 comments - [Understanding ML Model Poisoning: How It Happens and How to Detect It](https://daily.dev/posts/understanding-ml-model-poisoning-how-it-happens-and-how-to-detect-it-ecbqam4ha) · InfoQ · 0 upvotes · 0 comments - [You Moved Inference On-Device for Privacy. You Also Shipped Your Moat to the Attacker.](https://daily.dev/posts/you-moved-inference-on-device-for-privacy-you-also-shipped-your-moat-to-the-attacker--a7t0tkln0) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-security](https://daily.dev/tags/ai-security), [#mlops](https://daily.dev/tags/mlops) [View this post on daily.dev](https://daily.dev/posts/medium-qab3bv8mm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-qab3bv8mm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-qab3bv8mm"},"datePublished":"2026-07-21T18:33:11.651Z","dateModified":"2026-09-14T06:51:34.512Z","description":"AI model supply chains face two distinct threats: malicious model artifacts (pickle-based code execution) and poisoned weights (behavioral backdoors baked into...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-qab3bv8mm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-security,mlops","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/medium-qab3bv8mm#faq","mainEntity":[{"@type":"Question","name":"How many poisoned documents does it take to backdoor a large language model?","acceptedAnswer":{"@type":"Answer","text":"Roughly 250 crafted documents injected into pretraining data can reliably backdoor a model, according to a study by Anthropic, the UK AI Security Institute, and the Alan Turing Institute. Notably, this number stays near-constant from 600M to 13B parameter models rather than scaling with model size, meaning a fixed, small amount of poisoned data is enough regardless of how large the target model is. Teams evaluating model supply-chain risk can follow research like this through daily.dev to stay ahead of poisoning threats."}},{"@type":"Question","name":"Can model signing or SLSA provenance detect a poisoned or backdoored model?","acceptedAnswer":{"@type":"Answer","text":"No, signing and provenance only authenticate origin, not behavior. They prove weights came from a specific publisher via a specific pipeline and were untampered since signing, but a model poisoned during training by seeding malicious documents into a scraped dataset can pass every signature and provenance check while still containing a working backdoor the publisher never knew about. Anyone hardening an AI pipeline can track these provenance-versus-behavior tradeoffs on daily.dev before choosing controls."}},{"@type":"Question","name":"What is OpenSSF Model Signing and how does it prevent Hugging Face namespace hijacking attacks?","acceptedAnswer":{"@type":"Answer","text":"OpenSSF Model Signing (OMS) is a Sigstore-based standard, driven by Google's open-source security team and already integrated into Kaggle and NVIDIA NGC, that binds the exact bytes of every model file to a verified identity via an OIDC-based transparency log. It stops namespace hijacking because an attacker who re-registers a deleted account's namespace can clone the README but cannot sign as the original publisher's verified identity, causing ingestion to fail closed. Engineers locking down model ingestion pipelines can follow tooling updates like this via daily.dev."}}]} ```