Atlantic Council on AI supply chain data security gaps

Policy framework identifying risks to seven data components in AI supply chains—training data, testing data, models, architectures, weights, APIs, SDKs—and recommending existing plus AI-specific security controls for data poisoning and neural backdoors.

The Atlantic Council report outlines a comprehensive framework for understanding data security risks across the AI supply chain, identifying seven key data components that require protection: training data, testing data, models themselves, model architectures, model weights, APIs, and SDKs. The analysis maps these components to existing cybersecurity best practices from NIST and ISO, finding that many traditional IT security controls—encryption, access controls, continuous monitoring—effectively address standard data risks across rest, motion, and processing states. However, the report identifies two critical gaps where existing practices fall short: training data poisoning attacks that require dedicated data filtering and validation mechanisms beyond standard access controls, and neural backdoor insertion through malicious training data or architecture manipulation that demands new AI-specific protections. The report emphasizes that policy has historically focused narrowly on single data components (training data quantity in 2017, model weights currently), risking lopsided security frameworks that leave other components exposed. It recommends that developers and organizations adopt comprehensive supply chain due diligence ('Know Your Supplier' practices) to understand data source provenance and ensure vendors implement appropriate controls, while policymakers broaden their view beyond training data to protect the full diversity of AI data components across multiple use cases—transportation safety, drug discovery, healthcare, defense—rather than focusing solely on chatbot training data.

title: Suspicious Data Access from Information Repositories
description: Detects processes reading training datasets, model weights, architectures,
  or SDK/API components from network shares, cloud storage mounts, or central repositories.
  Targets T1213 data exfiltration from repositories housing AI supply chain components.
tags:
- attack.collection
- attack.t1213
logsource:
  category: file_event
  product: windows
detection:
  selection:
    FileName|endswith:
    - .bin
    - .pt
    - .pth
    - .onnx
    - .pb
    - .h5
    - .keras
    - .pkl
    TargetFilename|contains:
    - \\\\?\\UNC\\
    - 'Z:'
    - 'Y:'
  selection_keywords:
    TargetFilename|contains:
    - training_data
    - model_weights
    - architecture
    - sdk
    - api_keys
  filter_system_accounts:
    User|contains:
    - SYSTEM
    - NETWORK SERVICE
  filter_development_tools:
    Image|endswith:
    - \git.exe
    - \svn.exe
    - \python.exe
    - \pip.exe
  condition: (selection or selection_keywords) and not filter_system_accounts and
    not filter_development_tools
falsepositives:
- Legitimate data scientists pulling training datasets during model development from
  shared repos
- CI/CD pipelines fetching model artifacts during automated testing
- Version control operations on model files by authorized development teams
level: medium
id: 5c547bc8-ecd8-5c8a-8506-4b17d8137d5b
status: experimental
author: Vorant

title: Network Sniffing or Man-in-the-Middle Activity on Model/Data Transit
description: Detects packet capture tools, ARP spoofing utilities, or network interception
  framework execution that could target API, SDK, or model weight communications in
  transit. Addresses T1040 and T1557 threats to supply chain data in motion.
tags:
- attack.collection
- attack.credential-access
- attack.t1040
- attack.t1557
logsource:
  category: process_creation
  product: windows
detection:
  selection_packet_capture:
    Image|endswith:
    - \tcpdump.exe
    - \wireshark.exe
    - \dumpcap.exe
    - \tshark.exe
    - \netsh.exe
    CommandLine|contains:
    - trace start
    - packet capture
    - capture
  selection_arp_spoof:
    Image|endswith:
    - \arpspoof.exe
    - \arpscan.exe
    CommandLine|contains:
    - -i
  selection_mitm_frameworks:
    CommandLine|contains:
    - mitmproxy
    - bettercap
    - ettercap
  filter_admin_context:
    User|contains: Administrator
  condition: (selection_packet_capture or selection_arp_spoof or selection_mitm_frameworks)
    and not filter_admin_context
falsepositives:
- Network administrators performing legitimate packet analysis for troubleshooting
- Security teams conducting authorized penetration tests with elevated privileges
- Authorized SOC staff running network diagnostics during incident response
level: high
id: 461d3f3a-2461-58dd-8d5d-774a9717edca
status: experimental
author: Vorant

title: Unauthorized Access via Trusted Relationship Exploitation
description: Detects authentication events or file access using service accounts,
  vendor credentials, or partner-provisioned identities accessing model repositories,
  training data stores, or API endpoints. Targets T1199 supply chain trust exploitation.
tags:
- attack.initial-access
- attack.persistence
- attack.t1199
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
    - git clone
    - pip install
    - git pull
    - curl https
    - wget https
    Image|endswith:
    - \git.exe
    - \pip.exe
    - \curl.exe
    - \wget.exe
    - \powershell.exe
  selection_vendor_pattern:
    CommandLine|contains:
    - vendor
    - supplier
    - partner
    - third-party
  filter_scheduled_tasks:
    ParentImage|endswith:
    - \svchost.exe
    - \taskhost.exe
  filter_interactive_user:
    User|contains:
    - Administrator
    - Developer
  condition: selection and selection_vendor_pattern and not filter_scheduled_tasks
    and not filter_interactive_user
falsepositives:
- Legitimate third-party vendor software deployments pulling updates from partner
  repositories
- Authorized CI/CD service accounts with vendor credentials in environment variables
- Multi-vendor orchestration tools regularly syncing partner-hosted model artifacts
level: medium
id: 8c0b400e-1da3-56ab-accd-47d8790aa226
status: experimental
author: Vorant

Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/securing-data-in-the-ai-supply-chain