Securing the AI Supply Chain: What Can We Learn From Developer-Reported Security Issues and Solutions of AI Projects?
cs.SE, cs.AI, cs.CR, cs.HC
Submitted: 2025-12-29
Updated: 2026-01-09
Code: https://github.com/huggingface/safetensors
Terminology
Sources
- Phi-4 Technical Report
- Practice-Informed, Practice-Ready: An AI security incident taxonomy
- A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Models
- Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems
- A Rusty Link in the AI Supply Chain: Detecting Evil Configurations in Model Repositories
- AI Failures in the Eyes of the Downstream Developer: A First Look at Concerns, Practices, and Challenges
- "I wasn't sure if this is indeed a security risk": Data-driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source npm Packages
- The Llama 3 Herd of Models
- DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning
- Towards an Improved Understanding of Software Vulnerability Assessment Using Data-Driven Approaches
- Exploring Vulnerabilities and Protections in Large Language Models: A Survey
- RoBERTa: A Robustly Optimized BERT Pretraining Approach
- Provenance Tracking in Large-Scale Machine Learning Systems
- Adversarial Robustness of Open-source Text Classification Models and Fine-Tuning Chains
- DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter
- Threat Assessment in Machine Learning based Systems
- Adversarial Training: A Survey
Related papers
- Falsification-Based Verification of LLM-Generated Optimization Models: Sound Test Batteries and Their Detection Limits
- GitSkills: A Dataset of Agent Skills on GitHub
- SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces
- PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring
- IntentCoding: Amplifying User Intent in Code Generation
- Incentives and Outcomes in Bug Bounties