Publish Poisoned Models
This is when a bad actor creates a fake or tampered-with AI tool and puts it on a public website where people download software. It is like someone leaving a poisoned drink in a public fridge, hoping an unsuspecting person will pick it up and use it.
An adversary distributes a compromised machine learning model via public channels like model registries or code repositories. This model can be an entirely new malicious creation or a modified version of a legitimate open-source model, designed to be integrated into a victim's workflow as part of an AI supply chain attack.
The act of staging a poisoned model—either a novel malicious architecture or a trojanized variant of an existing open-source model—within a public-facing repository or registry. This technique facilitates AI supply chain compromise (AML.T0010) by leveraging the trust inherent in public distribution channels to introduce backdoored or adversarial weights into a victim's downstream inference or training pipeline.