OWASP's LLM03:2025 Supply Chain entry covers risks in training data, models and deployment platforms, and lists ten prevention and mitigation steps. This post turns them into a checklist you can assign to owners: vet suppliers, patch components, evaluate models, keep an AI inventory, check licenses, use verifiable sources, and more.
What the entry covers
OWASP describes LLM supply chains as vulnerable at the level of training data, models and deployment platforms. Beyond ordinary dependency risk, ML systems depend on third party pre-trained models and datasets that can be tampered with or poisoned. The entry also notes that open-access models, LoRA and PEFT fine-tuning, and on-device LLMs widen the attack surface.
It lists nine common vulnerability types, including vulnerable third party packages, licensing risks, outdated or deprecated models, vulnerable pre-trained models, weak model provenance, vulnerable LoRA adapters, exploited collaborative development processes, on-device model weaknesses, and unclear terms and privacy policies.
The ten mitigations as a checklist
- Vet suppliers. Review data sources and suppliers, including their terms and privacy policies, and audit them regularly. Owner: procurement or security.
- Patch components. Apply vulnerability management and patching to libraries. Owner: engineering.
- Evaluate before choosing. Run red teaming and evaluations on a third party model before selecting it. Owner: ML team.
- Keep an inventory. Maintain a signed SBOM, extended to AI BOMs and ML SBOMs. Owner: platform.
- Check licenses. Inventory licenses across software, tools and datasets. Owner: legal with engineering.
- Use verifiable sources. Prefer model sources with signing, file hashes and code signing. Owner: platform.
- Watch collaborative environments. Monitor and audit shared model development spaces. Owner: security.
- Test models and data. Apply anomaly detection and adversarial robustness tests to supplied models and data. Owner: ML team.
- Maintain a patching policy. Rely on maintained APIs and model versions. Owner: engineering.
- Protect edge models. Encrypt on-device models, add integrity checks and use vendor attestation. Owner: mobile and embedded teams.
The owners are my suggestions. OWASP lists the steps, not who should do them.
Turning the list into practice
Start with the three that cost least: pin revisions, record file hashes, and write down the license of every model you use. Then add an approval step before any new model reaches production, as described in the model intake policy post.
Pick two or three attack scenarios from the entry that match your setup, such as a vulnerable Python library or a fine-tuned popular model with a poor provenance trail, and ask whether your current process would catch them.
What to leave out
Do not treat the list as a certification. It is guidance, and a few items, such as vendor attestation on edge devices, depend on what your vendors can actually provide.
Quick check
Is OWASP LLM03 only about models?
No. It covers training data, models and deployment platforms, plus ordinary third party packages.
Where should I start?
Pin revisions, record hashes and license terms for each model, and add an approval step before production.
Sources
Last reviewed: 19 October 2026.
