> ## Documentation Index
> Fetch the complete documentation index at: https://doc.blueapi.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Model Supply Chain Security

> End-to-end model supply chain with checkpoint gates, attack vectors, and mitigations for tampered weights, poisoned models, and malicious tokenizers.

EMEP treats every model as a software artifact with a verifiable provenance chain. This page defines the full supply chain from source discovery through deployment, with checkpoint gates that enforce integrity at each transition.

## Supply Chain Flow

```mermaid theme={null}
flowchart LR
    START([START]) --> DISCOVER[Source Discovery]
    DISCOVER --> GATE1{Hash Verified?}
    GATE1 -->|NO| QUARANTINE1[Quarantine]
    GATE1 -->|YES| DOWNLOAD[Download + Hash Check]
    DOWNLOAD --> GATE2{Signature Valid?}
    GATE2 -->|NO| QUARANTINE2[Quarantine]
    GATE2 -->|YES| REGISTRY[Registry Entry]
    REGISTRY --> MERGE[Merge]
    MERGE --> GATE3{Merge Validation Pass?}
    GATE3 -->|NO| QUARANTINE3[Quarantine]
    GATE3 -->|YES| CANDIDATE[Candidate]
    CANDIDATE --> EVAL[Evaluation]
    EVAL --> GATE4{Safety + Regression Pass?}
    GATE4 -->|NO| QUARANTINE4[Quarantine]
    GATE4 -->|YES| RELEASE[Release]
    RELEASE --> DEPLOY[Deployment]
    DEPLOY --> END([END])
```

Each gate is a hard stop. A failure at any gate triggers quarantine and incident logging.

## Checkpoint Gates

| Gate   | Check                                             | Component        | Failure Action                |
| ------ | ------------------------------------------------- | ---------------- | ----------------------------- |
| Gate 1 | SHA-256 hash matches published value              | ModelLoader      | Quarantine; alert ops         |
| Gate 2 | Signature verifies against known key              | ArtifactStore    | Quarantine; flag key rotation |
| Gate 3 | Tensor shape match; no NaN/Inf spikes             | MergeEngine      | Quarantine; abort merge       |
| Gate 4 | Safety eval PASS; no regression on Validation Set | EvaluationEngine | Quarantine; candidate FAIL    |

## Attack Vectors

| Vector               | Description                                                  | Mitigation                                             |
| -------------------- | ------------------------------------------------------------ | ------------------------------------------------------ |
| Model poisoning      | Weights manipulated to inject backdoor behavior              | Hash verification + signature check at Gate 1 and 2    |
| Dependency confusion | Malicious package with same name as internal dependency      | Exact pinning + SBOM + offline mirror                  |
| Tampered weights     | Weights replaced after download                              | Hash check at every load; signed artifacts             |
| Malicious tokenizer  | Tokenizer vocab or rules altered to leak data or bias output | Tokenizer hash pinned in registry; compatibility check |
| Backdoor triggers    | Hidden triggers activate harmful outputs                     | Safety evaluation at Gate 4; red-teaming               |
| License laundering   | Model released under incompatible license after merge        | License compliance matrix enforced before merge        |

## Provenance Chain

Every model in the registry carries a provenance record:

* Source URL and commit hash
* Download timestamp and verifier identity
* Hash algorithm and value
* Signature and key identifier
* Merge parents and strategy
* Evaluation results and benchmark version

The provenance chain is immutable after release. Corrections create a new release with a superseded-by link.

## Incident Response

A quarantined model is moved to an isolated storage prefix with no read access from MergeEngine, EvaluationEngine, or DeploymentManager. An alert fires with severity P2. The incident record includes the gate, the check that failed, the artifact ID, and the timestamp. Recovery requires manual review and explicit unquarantine by an operator with security role.

## Cross-Links

* [Artifact Signing](/security/artifact-signing)
* [License Compliance](/security/license-compliance)
* [Security Requirements](/security/security-requirements)
* [Model Provenance](/tracking/model-provenance)