Atlantic Council on AI supply chain data security gaps

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Policy framework identifying risks to seven data components in AI supply chains—training data, testing data, models, architectures, weights, APIs, SDKs—and recommending existing plus AI-specific security controls for data poisoning and neural backdoors.

Sourceatlanticcouncil.org — open the original

The Atlantic Council report outlines a comprehensive framework for understanding data security risks across the AI supply chain, identifying seven key data components that require protection: training data, testing data, models themselves, model architectures, model weights, APIs, and SDKs. The analysis maps these components to existing cybersecurity best practices from NIST and ISO, finding that many traditional IT security controls—encryption, access controls, continuous monitoring—effectively address standard data risks across rest, motion, and processing states. However, the report identifies two critical gaps where existing practices fall short: training data poisoning attacks that require dedicated data filtering and validation mechanisms beyond standard access controls, and neural backdoor insertion through malicious training data or architecture manipulation that demands new AI-specific protections. The report emphasizes that policy has historically focused narrowly on single data components (training data quantity in 2017, model weights currently), risking lopsided security frameworks that leave other components exposed. It recommends that developers and organizations adopt comprehensive supply chain due diligence ('Know Your Supplier' practices) to understand data source provenance and ensure vendors implement appropriate controls, while policymakers broaden their view beyond training data to protect the full diversity of AI data components across multiple use cases—transportation safety, drug discovery, healthcare, defense—rather than focusing solely on chatbot training data.

title: Network Sniffing or Man-in-the-Middle Activity on Model/Data Transit
description: Detects packet capture tools, ARP spoofing utilities, or network interception
  framework execution that could target API, SDK, or model weight communications in
  transit. Addresses T1040 and T1557 threats to supply chain data in motion.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
- attack.t1557
logsource:
  category: process_creation
  product: windows
detection:
  selection_packet_capture:
    Image|endswith:
    - \tcpdump.exe
    - \wireshark.exe
    - \dumpcap.exe
    - \tshark.exe
    - \netsh.exe
    CommandLine|contains:
    - trace start
    - packet capture
    - capture
  selection_arp_spoof:
    Image|endswith:
    - \arpspoof.exe
    - \arpscan.exe
    CommandLine|contains:
    - -i
  selection_mitm_frameworks:
    CommandLine|contains:
    - mitmproxy
    - bettercap
    - ettercap
  filter_admin_context:
    User|contains: Administrator
  condition: (selection_packet_capture or selection_arp_spoof or selection_mitm_frameworks)
    and not filter_admin_context
falsepositives:
- Network administrators performing legitimate packet analysis for troubleshooting
- Security teams conducting authorized penetration tests with elevated privileges
- Authorized SOC staff running network diagnostics during incident response
level: high
id: 461d3f3a-2461-58dd-8d5d-774a9717edca
status: experimental
author: Vorant

title: Unauthorized Access via Trusted Relationship Exploitation
description: Detects authentication events or file access using service accounts,
  vendor credentials, or partner-provisioned identities accessing model repositories,
  training data stores, or API endpoints. Targets T1199 supply chain trust exploitation.
tags:
- attack.initial-access
- attack.persistence
- attack.t1199
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
    - git clone
    - pip install
    - git pull
    - curl https
    - wget https
    Image|endswith:
    - \git.exe
    - \pip.exe
    - \curl.exe
    - \wget.exe
    - \powershell.exe
  selection_vendor_pattern:
    CommandLine|contains:
    - vendor
    - supplier
    - partner
    - third-party
  filter_scheduled_tasks:
    ParentImage|endswith:
    - \svchost.exe
    - \taskhost.exe
  filter_interactive_user:
    User|contains:
    - Administrator
    - Developer
  condition: selection and selection_vendor_pattern and not filter_scheduled_tasks
    and not filter_interactive_user
falsepositives:
- Legitimate third-party vendor software deployments pulling updates from partner
  repositories
- Authorized CI/CD service accounts with vendor credentials in environment variables
- Multi-vendor orchestration tools regularly syncing partner-hosted model artifacts
level: medium
id: 8c0b400e-1da3-56ab-accd-47d8790aa226
status: experimental
author: Vorant

Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/securing-data-in-the-ai-supply-chain

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.