A data science team downloaded a pretrained model and a fine-tuning dataset from a public hub. Months later, the publisher's account is found to have been compromised, and the model contains a hidden backdoor behavior. Which risk category is this, and which control most directly reduces it?

AI supply chain risk covers threats introduced through third-party components: pretrained models, datasets, fine-tuning adapters, and the libraries that load them. A compromised publisher account can distribute a model with a hidden backdoor that behaves normally until a trigger appears, and serialization formats that execute code on load add further risk. The most direct control is provenance and integrity verification: obtain models from trusted sources, check cryptographic signatures and hashes, maintain an inventory or bill of materials for AI components, and scan artifacts before use. Restricting tool access addresses excessive agency, which limits harm when a model takes actions; it can reduce impact but does nothing to stop a tampered model from entering the environment. System prompt leakage concerns secrets placed in the model's instructions, which is unrelated to where the weights came from. Unbounded consumption concerns resource exhaustion and denial of wallet, not backdoored behavior. Exam caveat: supply chain risk includes datasets as well as weights, since poisoned fine-tuning data produces the same backdoor effect. Operational check: record each model's source, version, and hash in an inventory, verify signatures at download, and re-evaluate models when a publisher reports a compromise.