Water-utility MLOps pulls a pretrained model from an unverified registry mirror. What supply-chain exposure is that?

Pulling a pretrained model from an unverified registry mirror exposes the water-utility MLOps supply chain to tampered weights or metadata. Mirrors can serve altered binaries that preserve advertised names while changing behavior, backdooring anomaly detection, or poisoning forecasting used for treatment and distribution decisions. Offensive AI assessments treat untrusted registries as supply-chain exposure requiring approved sources, signature verification, and hash pinning. A compromised upstream open-source library in the SCADA analytics dependency tree cannot authenticate model artifacts. A compromised upstream open-source library in the SCADA analytics dependency tree fails by concept: a dependency-chain issue does not verify model integrity. A misconfigured local model version cache causing stale inference in the operations dashboard is an operations caching issue, not registry trust. A leaked training data archive exposing historic pump pressure logs externally is a data-exposure issue and irrelevant to whether weights match a signed upstream release. Distractors pull attention toward dependency, caching, or data-exposure issues instead of MLOps provenance. Exam caveat: a mirror that was trustworthy last quarter can diverge after a compromise or silent re-host; continuous verification and short-lived trust anchors matter more than a one-time bookmark. Operational check: configure pipelines to pull only from the city’s approved registry endpoint, enforce signature or digest checks before promotion, quarantine models fetched from unknown mirrors, and re-run critical water-quality model evaluations after any source change.