LATIDIA · Ciberseguridad

Modelos vulnerables en la cadena de suministro de IA: un estudio empírico de patrones de adopción, propagación y uso

arXiv:2610.12893v1 Tipo de anuncio: nuevo Resumen: La rápida integración de los modelos de Inteligencia Artificial (IA) ha establecido una cadena de suministro compleja, pero muchos de estos artefactos compartidos albergan vulnerabilidades graves como

La noticia

arXiv:2610.12893v1 Announce Type: new Abstract: The rapid integration of Artificial Intelligence (AI) models has established a complex supply chain, but many of these shared artifacts harbor severe vulnerabilities such as insecure serialization and architectural backdoors. While prior efforts have extensively scanned model registries to flag malicious artifacts, a critical gap remains in understanding how developers actually adopt and integrate these unsafe models into downstream software systems. We bridge this gap by conducting a large-scale empirical study on the usage and propagation of 16,977 known vulnerable models on HuggingFace flagged by InsightDB. We track their prevalence across GitHub repositories, software packages, fine-tuning chains, and deployed applications. Our analysis reveals that, despite