Yes. A model, adapter or dataset you download for a prototype is a third-party input, just like a code package. OWASP lists supply chain as its own LLM risk because these artifacts can be tampered with or poisoned. Record where each came from, check what it can execute, and approve it before production.
What OWASP says
The OWASP GenAI Security Project's 2025 list includes LLM03, Supply Chain. It says LLM supply chains are susceptible to vulnerabilities that can affect the integrity of training data, models and deployment platforms, and that in machine learning the risks extend to third-party pre-trained models and data, which can be manipulated through tampering or poisoning attacks. It also points to fine-tuning methods and open-access models on public platforms as sources of new supply chain risk.
For a prototype, the practical meaning is this: the model file you grabbed on Friday is an unreviewed dependency.
Four questions for every model
1. Where did it come from? Record the exact source, the publisher and the version or hash. "Some model from the internet" is not an answer.
2. What format is it in? Some file formats can carry executable code that runs when the file is loaded. Prefer formats designed for plain data, and read your framework's documentation on safe loading.
3. Can you reproduce it? If a publisher changes or removes the model, will your prototype break or silently pick up different behaviour? Pin to a specific revision.
4. What does the license allow? Licenses for models vary, and some limit commercial use. Check it before promoting a prototype, and ask your legal team if it is unclear. This article is not legal advice.
A one-line intake record
| Field | Example entry |
|---|---|
| Name and version | Model name plus revision or hash |
| Source | Publisher and location |
| Format | File type and loader used |
| License | Name and link |
| Approved by | Person and date |
| Used in | Prototype name |
This takes two minutes and answers most future audit questions.
Where models hide in a prototype
- A download line in a notebook or setup script.
- An adapter or fine-tune applied on top of a base model.
- A dataset fetched at start-up.
- A hosted model reached through an API key.
Search the repository for each. Hosted models also need an entry, since a change on the provider's side changes your behaviour.
Moving to production
Before launch, pin every model and dataset, store approved copies in a location you control if your policy requires it, and keep the intake records with the repository. Treat updates like dependency updates: review, test, then promote.
Where Safeguard fits
Safeguard scans software dependencies and generates SBOMs, which covers the code side of a prototype. Model approval remains a process you own, and the record above is a good place to start. Try a free scan at gold.safeguard.sh/scan.
Quick check
Do I need to record hosted models too?
Yes. Note the provider, model name, version and the date you tested, because behaviour can change when the provider updates it.
Is a popular model automatically trustworthy?
No. Popularity is not review. Check the source, format and license regardless.
Sources
Last reviewed: 19 October 2026.
