How would you secure the ML model supply chain?

Threat: compromised pre-trained model from HuggingFace/PyPI introduces backdoor (e.g., specific input triggers malicious behaviour). Defence layers: (1) Model registry with signed checkpoints (Sigstore, AWS SageMaker Model Registry signed); (2) SBOM (Software Bill of Materials) for ML pipelines including model + framework + data sources; (3) Reproducible training (deterministic seeds, locked dependencies); (4) Model scanning tools (HiddenLayer Model Scanner, Protect AI ModelScan); (5) Behavioural testing on adversarial input batteries before production; (6) CI/CD integration scanning every model artifact pre-deploy. Real incidents: 2024 PyTorch supply chain attack via dependency hijacking — these are real, not theoretical.