Recent measurements put hard numbers on this. A representative production AI stack (sourced from GitHub) comprising around 50 open-source projects declares around 5,000 direct dependencies, resolves to around 12,000 transitive packages and totals roughly 400 million lines of code. For every line of code an operator deliberately selects, nearly four more enter the system automatically — code they never chose, never reviewed and frequently do not know exists.
This is the AI supply chain. It is large, heterogeneous and, most critically, unmanaged.
Four incidents, one condition
Consider four events from the past two years.
In February 2024, researchers disclosed that roughly one hundred models hosted on Hugging Face, the de facto distribution hub for open-weight AI, carried payloads that executed arbitrary code on any machine that loaded them.
Two months earlier, the Stanford Internet Observatory identified over one thousand instances of child sexual abuse material within LAION-5B, a dataset underlying Stable Diffusion and an unknowable long tail of derivative generators.
In early 2026, attackers compromised a dependency in LiteLLM’s continuous integration pipeline and published a backdoored release that exfiltrated cloud credentials, SSH keys and Kubernetes secrets.
Meanwhile, operators building on frontier model APIs reported silent behavioural shifts. On one widely cited benchmark, GPT-4’s accuracy in identifying prime numbers fell from 84% to 51% over three months, with no version selector for rollback and no published changelog.
These are not four unrelated failures. They are four symptoms of one condition: the integrity mechanisms that took decades to mature in traditional software do not transfer to AI.
Reproducible builds, semantic versioning, signed attestations and dependency lockfiles all rest on a single assumption: that software behaviour is deterministic and inspectable. Given identical source code and environments, a traditional build produces bit-identical output, so any auditor can recompile it and detect tampering through a hash comparison.
Trained artefacts shatter this assumption. Model weights encode behaviour not in readable logic but in learned parameters shaped by data, stochastic optimisation and hardware-specific arithmetic. Two runs of the identical procedure on identical hardware produce different weights. You cannot inspect a checkpoint to know what it will do. You cannot rebuild it to prove that it was not tampered with.
Four Structural Gaps in the AI Software Supply Chain
This single property creates four structural cybersecurity gaps in the AI software supply chain, each of which maps to a business exposure that boards should already be tracking.
Checkability fails because trained artefacts cannot be reproduced bit for bit. A backdoored checkpoint can carry a valid attestation chain; a hash mismatch on re-execution proves nothing because a mismatch is expected. Attestation frameworks such as SLSA and in-toto do not close this gap so much as relocate it, shifting trust from the artefact to the attestor.
Versioning fails because compound AI systems carry undeclared behavioural couplings that no resolver enforces. A LoRA adapter requires the exact base checkpoint against which it was trained. A retrieval index is valid only for the embedding model that produced its vectors. A prompt template encodes assumptions about output format. None of these dependencies appears in any manifest. Update the embedding model and you serve a stale index with no error or crash, but with quietly worsening answers.
Transparency fails because AI systems degrade silently rather than crashing. Latency dashboards report healthy p99 times while answer quality collapses. Worse still is the attribution problem: when three artefacts change within the same fortnight, no telemetry identifies which one caused the regression.
Provenance fails because AI lineage is multi-parent, non-deterministic and cross-organisational. A distilled checkpoint inherits from both its teacher and its dataset; a merged checkpoint inherits independently from every source. When the LAION-5B contamination surfaced, the recommendation to deprecate affected models proved impossible to automate: no software connected the dataset to its derivatives.
From Paralysis to Prioritisation
Here is where the response usually stalls. Confronted with 400 million lines of code, executives face an arithmetic impossibility: securing everything is unfundable; securing nothing is negligent. The instinct is to focus on the model because it is visible and regulated. This instinct is wrong, and network science can prove it.
The AI supply chain is a network. Model it as a graph in which nodes represent components and artefacts, while edges represent “uses” and “derived-from” relationships. The abstract question — where is our risk? — then becomes concrete and measurable.
The concept of network centrality helps identify the vital few. Degree centrality surfaces the components on which the largest number of others depend. Betweenness centrality exposes chokepoints through which most dependency paths flow.
Eigenvector centrality identifies components whose importance derives from their connections to other important components. Blast radius then quantifies the consequences by traversing outwards from any node to count what a compromise would reach.
Consider a real-world archetype: an AI system that reads chest CT scans and flags suspicious lung nodules for radiologist review, deployed on premises across 200 hospitals. Its supply chain contains the same approximately 11,500 packages. Graph analysis reveals that five nodes — the image preprocessing library, the CI/CD pipeline, the model checkpoint, the CUDA driver stack and a single clinical threshold configuration file — sit on every causal path from a supply chain defect to a missed diagnosis. That is 0.04% of the network governing essentially all patient risk.
Two findings from that exercise deserve emphasis.
First, the analysis contradicts intuition. The team’s instinct was to focus on “the model”. Betweenness centrality flagged the CI/CD pipeline as equally or more dangerous because a compromise there can substitute any model, silently, across all 200 sites while emitting valid signatures — precisely the mechanism of the LiteLLM breach.
Second, blast radius must be denominated in the units that matter. In conventional IT, blast radius counts affected systems. Here, it should count patients per year: 200 sites × approximately 2,000 scans annually ≈ 400,000 people downstream of any single-point failure. That re-denomination makes the analysis intelligible to a Chief Medical Officer, a hospital risk committee and a regulator. None of them acts on “degree centrality 200”; all of them act on 400,000 patients.
The clinical threshold file demonstrates why both metrics are needed. It has a degree of one; every centrality measure classifies it as negligible. Yet it influences every triage decision in every hospital. Raise it and cancers are missed; lower it and radiologists drown in false positives until they stop trusting the system. A one-line configuration change alters patient outcomes without touching a byte of model weights. Centrality is blind to this; outcome-weighted blast radius captures it.
None of this is novel management science; it is the rediscovery of an established discipline in a new domain. ABC classification — Pareto’s law of the vital few, operationalised in inventory control for a century — provides the tiering: A-class assets receive maximum control, B-class assets balanced control and C-class assets light control. The theory of constraints explains why hardening high-betweenness chokepoints yields disproportionate resilience. Risk-based capital allocation formalises the objective: maximise expected-loss reduction per pound spent, not breadth of coverage.
In practice, this yields a tractable programme. For A-tier nodes: lockfiles that pin the jointly validated assembly; hardware-rooted attestation for the training run; drift alerts at a 5% deviation, with escalation in under 15 minutes; signed lineage attestations; and hardened CI/CD with split credentials. For C-tier nodes: automated updates and routine scanning. The economics work precisely because expensive controls apply to five nodes, not eleven thousand.
Three caveats keep this honest. Package managers resolve only declared dependencies — the preprocessing-to-model coupling exists in no manifest and must be added manually. Blast-radius weighting must be developed by domain experts, not engineers alone. And the graph is dynamic; centrality that is recomputed only annually will decay into a stale artefact.
The Mandate
Organisations that act now will detect incidents in hours rather than weeks, scope them automatically rather than manually and meet regulatory requirements that are visibly approaching. Those that do not will discover their exposure in the same way the sector has discovered it so far: retrospectively, publicly and expensively.
The core proposition is simple and should be uncomfortable. In a chatbot, silent supply chain degradation is a quality problem. In a hospital, it is a mortality statistic. The difference is not the technology; it is whether anyone was measuring the chain.
There is no AI safety without AI supply chain integrity.