Machine Learning Models Have a Supply Chain Problem

The paper highlights the supply-chain risks associated with open machine learning models, such as malicious replacements or training on compromised data, which have already been exploited in attacks. It proposes using Sigstore to enhance transparency by enabling model publishers to sign their models and verify dataset properties, thereby improving security in the open ML ecosystem.