A typical AI feature might use a model downloaded from a public hub, fine-tuned on a dataset from a vendor, served with a dozen open-source libraries and connected to outside tools through APIs. Each is a dependency someone else controls. A tampered model file can run malicious code when loaded (Hugging Face warns that pickle files, the default format for PyTorch weights, can execute arbitrary code), a poisoned dataset can plant hidden behavior, and a compromised library can leak data. OWASP lists these as the supply-chain risk for LLM applications.
An AI-BOM applies the software bill of materials idea to AI. It records which models (and versions), datasets, licenses and libraries a system uses, so a team can answer “are we affected?” when a vulnerability or license problem appears. The CycloneDX standard has an ML-BOM capability and SPDX 3.0 includes an AI profile; OWASP describes AI BOMs as an emerging area.
Integrity also depends on knowing who changed what. In episode 65 at 38:52, Ledger CTO Charles Guillemet says “the integrity of your supply chain is a big one” and describes signing commits and releases so production code can be traced to the right developer. That is his recommendation from hardware security. Editorially, the AI supply chain extends data provenance to every component and connects to open weights adoption, model extraction attacks and broader AI governance.
Hear it from the guest
“The integrity of your supply chain is a big one”
Quotes lightly edited to remove filler words.
Sources
- OWASP: LLM03:2025 Supply Chain — Covers risks from third-party models, datasets and packages and recommends a signed software bill of materials, noting AI BOMs and ML SBOMs are an emerging area; checked October 24, 2026.
- CycloneDX: Machine Learning Bill of Materials (AI/ML-BOM) — BOM standard capability for model and dataset transparency for security, privacy, safety and ethical considerations; checked October 24, 2026.
- SPDX 3.0.1: AI Profile — Standardized way to document and share information about AI software packages, including fields such as intended use, known bias and energy consumption; checked October 24, 2026.
- Hugging Face: Pickle Scanning — Explains that loading pickle files, the default format for PyTorch weights, can execute arbitrary code, and recommends trusted sources and safer formats; checked October 24, 2026.
