A security architect is designing secure model deployment pipelines for an organization that fine-tunes foundation models using proprietary training data. The architect is concerned about supply chain attacks where a malicious actor injects backdoors into pre-trained model weights downloaded from public repositories. Which control mitigates this risk?

B is correct because verifying the cryptographic hash (SHA-256 or similar) of downloaded model weights against publisher-provided checksums ensures the model files have not been tampered with in transit or replaced with malicious versions. This is analogous to software supply chain integrity verification and directly mitigates backdoor injection through tampered model files. A is wrong because HTTPS protects data in transit from eavesdropping and tampering, but it does not verify that the model weights served by the source are themselves clean—a compromised model repository can serve backdoored models over HTTPS. C is wrong because storing models in private Blob Storage prevents unauthorized access to stored models, but it does not verify the integrity of models before they are stored. D is wrong because traditional antivirus tools detect known malware signatures in executable files; they cannot detect semantic backdoors embedded in neural network weight tensors.