LLM03:2025 Supply Chain is the OWASP risk that a model, dataset, adapter or library you pulled in was weak, tampered with or mislabeled before it reached you. It is a normal software supply chain problem with a harder twist: a model file is a black box that code review cannot read.
This post walks through the OWASP entry, picks the real world cases it lists, and turns its mitigations into a short checklist. It is defensive only and contains no attack steps.
What does OWASP say the risk is?
OWASP describes LLM supply chains as vulnerable at several points: training data, models and deployment platforms. Compromise can produce "biased outputs, security breaches, or system failures." Unlike traditional software, the risk extends to third party pre-trained models and data that can be manipulated through tampering or poisoning. The entry ties the rise of open access models, LoRA and PEFT fine-tuning and on-device LLMs to new exposure.
Which parts are familiar and which are new?
Familiar: outdated components, license obligations and unmaintained dependencies. OWASP lists traditional third party package vulnerabilities first, and points to OWASP A06:2021, vulnerable and outdated components, as the control to apply.
New:
- Models are binary black boxes. OWASP says static inspection offers limited assurance, and models can hide backdoors created by poisoned data or direct tampering.
- Weak provenance. Model cards "offer no guarantees on the origin of the model." An attacker can compromise a supplier account or publish a lookalike repository.
- Adapters. A malicious LoRA adapter can compromise the base model it is merged into.
- Shared merge and conversion services. These can introduce vulnerabilities into shared models.
- On-device models. Repackaged apps can ship a tampered model.
- Unclear terms. An operator's terms and privacy policy may allow your data to be used for training.
What real cases does the entry cite?
OWASP names several. Each is worth reading as a pattern, not a headline:
- A compromised PyTorch dependency distributed through PyPI, and the Shadow Ray attack on the Ray framework. Pattern: an ordinary package vulnerability inside ML tooling.
- PoisonGPT, a model with altered parameters published to spread misinformation. Pattern: direct tampering with a public model.
- WizardLM, where a fake, malware-laced version of a removed model appeared under the same name. Pattern: a lookalike filling a gap when the original disappears.
- HiddenLayer's research on a model format conversion service. Pattern: the conversion step is itself an attack surface.
- Tampered models inside mobile apps, which OWASP says affected 116 Google Play apps. Pattern: the model file is replaceable like any other asset.
- LeftOvers, CVE-2023-4969, recovering data from leaked GPU local memory. Pattern: shared infrastructure.
Which controls does OWASP recommend?
Ten, grouped here by who owns them:
- Procurement. Vet suppliers and their terms, and audit them regularly for changes.
- Engineering. Scan and patch components. Keep a signed inventory as an SBOM, and evaluate AI BOMs and ML SBOMs starting with CycloneDX. Use only models from verifiable sources and check signatures and file hashes.
- Security testing. Run AI red teaming and evaluations on third party models for your use case, since models can be fine-tuned to pass published benchmarks.
- Operations. Monitor collaborative model environments, use anomaly detection, keep a patching policy, and for edge deployments encrypt models with integrity checks.
What to do
- List every model, adapter, dataset and ML library you use, with source and version.
- Add it to your SBOM process, using a format that can describe models.
- Pin models by hash and verify before loading. Prefer publishers you can identify.
- Scan the Python and JavaScript dependencies around the model like any other code.
- Evaluate third party models on your own tasks before production.
- Record license terms for each model and dataset.
- Read the data use terms of any hosted model provider and put the date you read them in the record.
- Decide who gets paged when an upstream model is withdrawn or flagged.
Quick check
Is LLM03 different from LLM04 data poisoning?
They overlap. OWASP says LLM03 focuses on the supply chain aspect, while LLM04 covers poisoning more broadly.
Does an SBOM help with models?
It helps with the inventory. OWASP recommends evaluating AI BOMs and ML SBOMs, starting with CycloneDX, and keeping the inventory signed and current.
Sources
Last reviewed: 18 October 2026.
