# NIST Releases Updated Guidance on Securing AI Model Supply Chains

NIST has issued new guidance on vetting third-party AI models and training data, treating a poisoned model the same way mature security teams already treat a compromised software dependency.

NIST has published updated guidance targeting a risk that's grown alongside the popularity of fine-tuning openly available models rather than training from scratch: what happens when the model or dataset you're building on has been tampered with.

A poisoned model behaves normally under almost all conditions but produces an attacker-controlled output when triggered by a specific input, usually the result of manipulated training data or a modified checkpoint file slipped into a public repository. Because those repositories function much like open-source package registries, a popular, widely reused model is a correspondingly attractive target.

The new guidance asks organizations to treat third-party models the way mature teams already treat third-party code:

- Maintain a bill of materials tracking exactly which model versions and datasets are in production use.
- Verify cryptographic signatures or checksums against the official source before deployment.
- Run behavioral testing on any externally sourced model, specifically probing edge-case and adversarial inputs before it goes live.
None of this is exotic advice, it's the software-supply-chain playbook applied one layer up, to the models and datasets instead of the code that calls them. Security and ML engineering teams that haven't inventoried their third-party models yet should start there; unofficial mirrors are the highest-priority items to check first.

Source: [NIST SP 800-218A: Secure Software Development Practices for Generative AI](https://csrc.nist.gov/pubs/sp/800/218/a/final)