Know exactly what is in your models and dependencies, prove where they came from, and stop malicious artifacts entering your pipeline, in two days. You produce an AI-SBOM for a model and its dependencies, sign and verify model artifacts, scan model files for unsafe payloads, and enforce verify-at-deploy. Maps to OWASP AISVS C6.
Most teams cannot say where a model came from, what data trained it, or whether the file on disk is the one they meant to run. This course closes that gap. You learn to record provenance and lineage, build an AI Bill of Materials, sign and verify every artifact, and scan model files for hidden payloads before they reach production. Every module maps to a requirement in OWASP AISVS C6, Supply Chain, taught by an AISVS project leader.
A single model pulled from a public hub can carry a pickled payload that runs code the moment you load it. A dependency swapped upstream can poison a build no one reviewed. Without provenance you cannot tell a clean artifact from a tampered one, and without an AI-SBOM you cannot answer a regulator asking what is inside your system. You fix this with recorded origin, signed artifacts, verified signatures at deploy time, and a scan that rejects unsafe files before they load.
Two-day instructor-led course. Module order and grouping can be adjusted for private deliveries.
What makes AI supply chains fundamentally different from traditional software supply chains. You study how training data, model weights, adapters and inference endpoints create a dependency chain that cannot be managed with standard SBOM tools alone, and you identify the new attack surfaces that AI introduces.
Tracing a model back to its origin, its training data and every transformation applied to it. You record the chain of custody at each step so you can prove where a model came from, who trained it, what data went into it and whether anything was changed after training.
Tracking where training and evaluation datasets come from and how they were processed. You document source, collection method, filtering, labelling and any transformations so you can answer questions about data lineage and detect when a dataset has been tampered with or contaminated.
Mapping the full dependency chain from training data through model weights to inference endpoint. You trace every component that your deployed model depends on, including libraries, base models, adapters, tokenisers and serving frameworks, and mark each point where a compromised dependency could enter.
Finding models that have been poisoned during training. You study how backdoors are planted through data poisoning and how they survive into deployed weights, then run detection techniques that identify poisoned behaviour without needing access to the original training data.
Technical backdoor detection methods for production models. You apply activation analysis, trigger scanning and behavioural testing to identify backdoors that fire only on specific inputs, and you measure the detection rate against known backdoor patterns.
Scanning model files in pickle, safetensors and GGUF formats for malicious payloads. You run ModelScan and Fickling against model files, catch serialisation attacks that execute code on load, and set up scanning gates that reject unsafe files before they enter your pipeline.
Signing model files with Sigstore and cosign so a tampered file fails verification instead of loading silently. You produce attestations that bind a signature to a build, verify signatures at load time and set up the cryptographic chain of trust from training to deployment.
The specific risks of using models from Hugging Face and other public model hubs. You study the attack surface of public model repositories, examine real incidents involving malicious uploads and configure your download and verification pipeline to treat public hubs as untrusted sources.
Creating an AI software bill of materials that captures models, datasets, adapters, licences and dependencies in one machine-readable inventory. You build an AI-SBOM with CycloneDX that a tool, an auditor and a regulator can read, and you learn what goes into it that a traditional SBOM does not cover.
What an AI-SBOM must contain that a traditional SBOM does not. You compare the two formats, identify the AI-specific fields for model provenance, training data, hyperparameters and evaluation results, and learn when you need both an AI-SBOM and a standard SBOM for the same system.
Using model cards and data cards as structured provenance documents alongside the AI-SBOM. You write a model card that records intended use, limitations, evaluation results and known risks, and a data card that documents the training dataset, so provenance is human-readable as well as machine-readable.
Scanning AI project dependencies with Syft, Grype and Trivy. You set up automated scanning that catches known vulnerabilities in Python packages, CUDA libraries, serving frameworks and other dependencies before they reach production.
Signing container images with Cosign so your inference containers have a verified identity. You sign images at build time, verify signatures at deploy time and reject any container that does not carry a valid signature from your trusted build system.
Verifying the integrity and authenticity of every artifact in your AI pipeline. You check hashes, validate signatures and confirm attestations for models, datasets, adapters and configuration files so nothing enters production without a verified provenance chain.
Producing provenance attestations following the SLSA framework adapted for AI. You generate attestations that record how a model was built, what data and code went into it and who authorised the build, so you can prove the provenance of any deployed model.
Assessing the security posture of AI suppliers and third-party model providers. You build a vendor assessment questionnaire that covers model provenance, data handling, security practices and incident response, and you score suppliers against the requirements before accepting their models into your pipeline.
A structured lab where you scan model files for malicious payloads, detect unsafe serialisation patterns and test backdoor detection techniques against prepared samples. You run ModelScan, Fickling and activation analysis tools and produce a scanning report.
A hands-on lab where you build a complete AI-SBOM for a model and its dependencies. You generate the bill of materials with CycloneDX, write the model card and data card, and verify that the AI-SBOM captures everything an auditor would ask for.
A lab where you simulate supply chain attacks against an AI pipeline. You plant a poisoned dependency, swap a model file, tamper with an attestation and test whether your scanning, signing and verification controls catch each attack before the compromised artifact reaches production.
Hands-on with the CyberSecAI tooling, not slideware.
Generates an AI-SBOM covering models, datasets, adapters and licences.
Signs and verifies model artifacts before deployment.
Supply-chain checks from the OWASP-standards scanner.
Signed provenance record for every model you accept.
Provenance, an AI-SBOM, signed artifacts and verify-at-deploy give you what a scan alone cannot: a recorded origin for every model and dependency, a signature that fails when a file is tampered with, and a hard stop on unverified artifacts reaching production. This is how you keep a malicious model or a poisoned dependency out of your pipeline, and how you answer an auditor asking what is inside your system.
No slideware. You build an AI-SBOM with CycloneDX, sign and verify artifacts with Sigstore and cosign, package a model with KitOps ModelKits, and scan model files with ModelScan and Fickling. You leave with a working pipeline that records provenance, signs every artifact, and rejects an unverified or unsafe model at deploy time.
Every artifact carries a recorded origin and a signature, so when you need to reconstruct what shipped you have provable evidence, not guesswork. This brings supply-chain discipline to model delivery, taught by the former OWASP-AISVS Co-Leader (v1.0).
Every model and dataset carries its origin, owner, license and processing history.
A CycloneDX AI-SBOM and ML-BOM a tool, an auditor and a regulator will accept.
Sigstore and cosign signatures that fail when a file has been tampered with.
ModelScan and Fickling catch pickle and serialization attacks before a model loads.
KitOps ModelKits bind a model, its data and its metadata into one signed, versioned unit.
Signatures and provenance checked in the pipeline, so an unverified artifact never ships.
Own the pipeline that packages, signs and ships models.
Add provenance, signing and model scanning to your remit.
Extend software supply-chain controls to models and datasets.
Design model delivery you can inventory, sign and verify.
This course counts toward the CyberSecAI AISVS assurance track. Assessment is practical: you produce an AI-SBOM for a model and its dependencies, sign and verify the artifacts, scan a model file for unsafe payloads, establish provenance and lineage, and enforce verify-at-deploy. On a passing result, the module is credited toward the track.
Two days, hands-on, taught by the former OWASP-AISVS Co-Leader (v1.0). Build an AI-SBOM, sign and verify model artifacts, scan for unsafe payloads, and enforce verify-at-deploy. Mapped to AISVS C6. Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.