Your supply chain is every model, dataset and package your system uses but did not build.
A checkpoint downloaded from a public hub is a file your code loads and trusts.
Older serialisation formats run arbitrary code at load time as part of how they work.
A dataset fetched from a URL can change after you evaluated it, without the URL changing.
Pin versions, verify checksums, prefer safetensors and treat an unknown uploader as untrusted code.
Your supply chain is every model, dataset, package and prompt your system depends on but did not build.
Almost no AI system is assembled from scratch, which makes this a large surface by default.
A model checkpoint is not a document, it is a file your code loads and immediately trusts.
Older serialisation formats execute arbitrary code at load time as part of how they are designed to work.
Downloading such a checkpoint and loading it is closer to running an installer than to opening a file.
Safetensors exists specifically to remove that behaviour, and it should be your default choice.
Public model hubs let anyone upload, and a plausible name guarantees nothing whatsoever.
Typosquatting works on model names in exactly the way it already works on package names.
A dataset fetched from a URL can change after you evaluated it, without the URL ever changing.
Weights themselves can carry a backdoor that no scan of the file will reveal.
Pin exact versions and commit hashes rather than tracking a tag that moves underneath you.
Verify checksums on download and keep a copy you control instead of fetching at run time.
Prefer publishers with a verifiable identity, and treat an unknown uploader as untrusted code.
Load an unfamiliar model in an isolated environment first, with no network access and no credentials present.
Record what went into each build, so a later disclosure can be traced to exactly what it affected.
One question on this card. Every option explains itself once you pick, right or wrong.
16 concepts in this module, then a graded test with every answer explained.