Как защищать model supply chain: weights provenance, signed releases, eval set integrity, NIST AI RMF?

Model supply chain — 4 точки компрометации: (1) malicious weights (PoisonGPT Mithril Security 2023, pickle RCE в .bin), (2) tampered datasets (BadNets-style poisoning), (3) eval set tampering (fake high scores), (4) dependency hijack (typosquatting langhain vs langchain). Защита: cosign / Sigstore подписи на HF model cards, safetensors вместо pickle, SHA256 hash-pin в model card + manifest, SLSA for AI build provenance, dataset manifest (hash + license + source), versioned + signed eval sets, pip-audit / Snyk / Dependabot для всех ML deps. Governance — NIST AI RMF 1.0 (Govern/Map/Measure/Manage), SBOM for ML. Triggered backdoor — невидим в standard evals, ловится только targeted red-teaming.