AI Security
How do you vet a Hugging Face model before you load it?
Prefer safetensors, pin a full commit hash, check the publisher, read the pickle import list, and load in a sandbox. A short checklist for ML teams.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
How do you publish a Hugging Face model with provenance?
Use safetensors, signed commits, CI trusted publishers and Sigstore model signing so consumers can verify who published your model and its integrity.
Oct 18, 20264 min read
AI Security
How do you pin Hugging Face models the way a lockfile pins packages?
Hugging Face has no lockfile, but a full commit hash in the revision argument gives the same guarantee. Record it, cache it, and verify before every deploy.
Oct 18, 20264 min read
AI Security
What does a malicious Hugging Face model look like, and what do you do?
Malicious models usually hide code in pickle imports. Learn the warning signs, what Hub scans cover and miss, and how to contain a model you loaded.
Oct 18, 20264 min read
AI Security
How do you avoid lookalike models and name confusion on Hugging Face?
Pin model IDs to the exact organization and a commit, prefer safetensors, leave remote code off, and keep model names in config you review as a dependency.
Oct 18, 20264 min read
AI Security
How do you secure AI-assisted software development?
Treat AI-written code as untrusted input, limit what coding agents can touch, and keep human review and tests in the loop. A practical guide from NIST.
Oct 18, 20264 min read
AI Security
How do you model AI supply chain risk?
List every model, dataset, library and tool your AI system depends on, then rate trust and impact for each. A method built on NIST, MITRE ATLAS and OWASP.
Oct 18, 20264 min read
AI Security
How do you mitigate LLM jailbreaking?
Jailbreaks make a model ignore its safety rules, and no filter fully stops them. Limit what the model can do, validate output and test it as hostile.
Oct 18, 20265 min read
AI Security
How to evaluate AI security claims from vendors
Ask what the AI decides, how it was tested, what data it sees and what happens when it is wrong. A practical list for buyers reading AI security claims.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.