AI and Machine Learning — Supply Chain Risks and Mitigations (NSA + Eight Nations, March 2026)
Overview
In March 2026, the NSA AI Security Center co-published the most comprehensive government guidance to date on AI and ML supply chain threats, co-signed by eight nations: the United States (NSA, CISA, FBI), Australia, Canada, Japan, New Zealand, South Korea, Singapore, and the United Kingdom. The guidance maps threats to six distinct AI/ML supply chain components and prescribes mitigations for each. Its framing principle — “security must be architected in from the first design decision, not retrofitted after the first incident” — positions supply chain security as a design property, not a compliance artifact.
The guidance addresses two distinct risk categories: attacks that exploit AI/ML supply chain weaknesses, and AI systems that are themselves the target of supply chain compromise.
Six-Component Threat and Mitigation Map
1. Training Data
Threats. Adversaries poison training datasets to degrade model outputs or install backdoors that activate on specific inputs. Compromised open-source datasets represent the most accessible attack vector; 53% of organizations pull models from registries containing known malicious payloads.
Mitigations. Quarantine external datasets in isolated environments before ingestion. Apply cryptographic data provenance (hash attestation at collection). Maintain data lineage records throughout the training pipeline. Monitor training metrics for anomalous divergence that may indicate poisoning.
2. Model Weights
Threats. Pre-trained models from public registries can carry latent backdoors that survive fine-tuning. Serialization formats like Pickle execute arbitrary code on load.
Mitigations. Migrate to safer serialization formats, specifically Safetensors. Verify model provenance via cryptographic signatures before loading. Maintain an AI-BOM that tracks model weight version, origin, and hash alongside software dependencies.
3. Software Dependencies
Threats. Compromised third-party packages propagate through the dependency graph. The LiteLLM compromise (95M monthly downloads, affected 36% of cloud environments) demonstrates the blast radius of a single poisoned library. Slopsquatting — where AI code generators hallucinate package names that attackers then register — introduces a second route that bypasses conventional typosquatting detection.
Mitigations. Enforce lockfiles with hash verification. Implement aggressive dependency scanning with least-privilege execution. Conduct pre-install scanning before any third-party package runs in a production environment. Maintain a private registry with an approved-package allowlist.
4. Infrastructure and Hardware
Threats. GPU cluster compromise and firmware manipulation can corrupt training runs or extract model weights. Shared or cloud-based training infrastructure creates multi-tenant risk.
Mitigations. Apply network segregation between training and inference environments. Use in-house authentication for GPU clusters rather than shared credentials. Monitor firmware versions against manufacturer advisories.
5. Third-Party APIs and External Data Sources
Threats. External data sources accessed by models at inference time are a prompt-injection surface. Adversarial content embedded in retrieved documents can manipulate model behavior without modifying the model itself.
Mitigations. Validate and sanitize third-party content before it reaches the model. Apply minimal permission sets to API integrations. Treat externally-retrieved content as untrusted input, analogous to SQL injection prevention in classical systems.
6. Deployment and Operations
Threats. Access control failures and monitoring gaps allow attackers to extract model weights, inject malicious inputs at scale, or degrade model availability through resource exhaustion.
Mitigations. Develop AI-specific incident response protocols covering model rollback, weight quarantine, and adversarial input investigation. Implement behavioral monitoring that detects distributional shift in model inputs and outputs. Apply the AI-BOM as a living inventory updated at every deployment.
Relevance to Enterprise Supply Chain Hardening
This guidance establishes the authoritative government-backed threat model for AI and ML supply chains. Its six-component structure provides the taxonomic anchor for enterprise control mapping:
- Components 1–2 (Training Data, Model Weights) bear primarily on organizations that train or fine-tune models, and on all organizations that consume pre-trained models from public registries.
- Components 3–4 (Software, Infrastructure) apply universally — every organization running software has a component 3 exposure.
- Components 5–6 (APIs, Deployment) apply specifically to organizations deploying inference pipelines or agentic systems that retrieve external content.
For organizations that consume AI capabilities without training their own models, components 3 and 6 carry the most immediate risk.
Component weighting for inference-only organizations
The guidance does not differentiate risk weights by organizational role (trainer vs. deployer vs. consumer). Enterprise practitioners need a calibrated view of which components matter most given their AI adoption posture.