Record summary
A quick snapshot of what this page covers.
Attack context
How this AI attack works in practice.
An adversary may compromise a victim's container registry by pushing a manipulated container image and overwriting an existing container name and/or tag. Users of the container registry as well as automated CI/CD pipelines may pull the adversary's container image, compromising their AI Supply Chain. This can affect development and deployment environments.
Container images may include AI models, so the compromised image could have an AI model which was manipulated by the adversary (See Manipulate AI Model).
- ATLAS ID
- AML.T0010.004
- Priority score
- 35
Mitigations
Defenses that may help against this attack.
Case studies
Examples from public reports and exercises.
AI Model Tampering via Supply Chain Attack
Researchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registries also had overly permissive access controls that allowed write access. In their analysis, the researchers found over 1,000 unique AI models embedded in private container images within these open registries that could be pulled without authentication.
This exposure could allow adversaries to download, inspect, and modify container contents, including sensitive AI model files. This is an exposure of valuable intellectual property which could be stolen by an adversary. Compromised images could also be pushed to the registry, leading to a supply chain attack, allowing malicious actors to compromise the integrity of AI models used in production systems.
Source
Where this page information comes from.
Original source
Original source links
Open the public records and source datasets used for this page.