Supply Chain Risk in Open Model Weights

The lab pulled a 'fine-tune of a well-known 8B' from a page that looked official. The checksum on the page did not match the file. Someone said close enough. The file contained a backdoor that triggered on a rare token and exfiltrated via a tool the desk should not have had. The page was a lookalike. The lab had skipped the receiving dock.

Open weights are a supply chain. They are also a licence chain and a provenance chain. 'Open' is not 'safe'. 'Open' is not 'yours to use in a government desk' until the licence says so. 'Open' is not 'the hashes match' until you check.

This teardown is for CIOs and architects on 17 August 2026. Not legal advice. SLSA and SPDX are community tools, not Indian statutes. Use them as docks, not as exemptions. CERT-In still cares if the node is compromised. DPDP still cares if the weight file memorised personal data you should not have put in a fine-tune.

Prcept will pin hashes and refuse mystery adapters. If a bidder cannot show a checksum and a licence paragraph, they are not offering open weights. They are offering a USB myth.

Three tickets at the dock

Checksum. Publish the algorithm and the digest you expect. Verify on a machine that is not the production node. Mismatch is a stop, not a shrug. Close enough is how lookalikes win.

Provenance. Who built it, from which base, on which date, with which data class. A username on a model hub is not provenance. A signed attestation, a reproducible build story, or at least a vendor-signed bill of materials is the start. SLSA language helps you ask; it does not bless a file.

Licence. Read the actual text. Some 'open' weights bar government or surveillance use, require a use-based grant, or change with version. SPDX identifiers help you name what you think you have. Counsel names what you may do. A GitHub badge is not counsel.

Receiving-dock fails we still see in government labs.

What arrived	What was skipped	What to require
Lookalike hub page	Canonical URL + hash	Pin the publisher and the digest in the file
Community fine-tune	Data class of the tune	No tune that saw personal or classified data you do not own
Converted safetensors of unclear origin	Provenance	Refuse or rebuild from a pinned base
Licence that forbids official use	Reading	Another weight, or a paid grant, in writing

Poison and backdoors

Weights can carry learned triggers. Research is no longer exotic. You will not detect every trigger with a weekend eval. You reduce the chance by taking weights from a short allowlist, by pinning, by running a hold-out eval that includes canary phrases, and by not granting tools that can exfiltrate if a trigger ever fires.

Adapters and LoRAs are weight files too. A 'small' adapter on a clean base is a clean way to smuggle a dirty behaviour. Receive adapters at the same dock. Do not let a data scientist sideload from a messaging group because the gap made downloads hard.

Tokenisers and chat templates are part of the chain. A template that silently prepends an instruction is a prompt injection you installed yourself.

The update path is the path

On a gapped estate, the stick is the internet. Two-person copy, current scanner, one purpose, checksum book. The air-gap opinion in this cluster is the wider argument. This page is the file that arrives on the stick.

On a connected estate, the pull itself is the path. Pin versions. Do not `latest`. Do not auto-update production because a hub was busy. Change-control the digest like you change-control a kernel.

If you must use a hosted model instead, you have traded this dock for a processor and a residency argument. That can be the right trade for public, non-personal FAQ. It is a different article. Do not pretend a hosted API has no supply chain. You just cannot see the dock.

• Allowlist of bases and publishers.
• Pinned digests in the departmental register.
• Licence paragraph initialled by counsel.
• Adapters treated as first-class artefacts.
• No messaging-group weights.

What open does not buy you

It does not buy you sovereignty by itself. A foreign-hosted download with telemetry is still a path. Running the same file in your SDC, with no callback, is a different path. Architecture, not the adjective open.

It does not buy you immunity from CERT-In duties if the node is owned.

It does not buy you a right to ignore the licence because you are government. If anything, you should be more careful.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

If the weights are public they are safe.

Public means many copies. It does not mean this copy is the one the publisher hashed, or that the publisher is who the page claims.

We do not have time to do SLSA.

Then do the minimum dock: canonical source, digest, licence, scanner, two-person. SLSA is a ladder. The floor is still a floor.

Our scientists need to try many models.

Try them in a sandbox that cannot see production data or production tools. Promote only pinned artefacts through the dock.

Closed APIs are safer.

They are different. You cannot inspect the weights. You take a processor, a meter, and a residency story. Safer is a fact pattern, not a brand.

A twelve-day receiving dock

Build the dock before the next download. Retro-hash what you already run.

1. Day 1–2: inventory every weight, adapter, tokeniser and template in production and staging.
2. Day 3–4: re-verify digests against canonical publishers. Quarantine mismatches.
3. Day 5–6: counsel reads licences for the ones you intend to keep.
4. Day 7–8: write the allowlist and the dock procedure, including air-gap media if you use it.
5. Day 9–10: sandbox versus production promotion path. No sideload.
6. Day 11–12: canary eval including trigger-like phrases. CISO signs the register.

How this shows up in the file

Subject: Model-weight receiving dock — register extract.

Only publishers [list] may enter production. Each artefact has digest [algo], licence [SPDX or named text], provenance note, and two-person receipt dated. Adapters are first-class. Mismatch is a stop and is treated as a security event. Messaging-group and unhashed files are prohibited. This is not a legal opinion on any licence. Counsel's note is attached.

Updates change the digest; they are change-controlled, not automatic.

Adapters are not small

A LoRA that is a few dozen megabytes can still change refusal behaviour, add a trigger, or smuggle a tool-use habit. Treat every adapter as a first-class weight. Same dock: digest, provenance, licence, two-person copy. A scientist's messaging-group adapter is not a patch. It is an unreviewed binary.

Chat templates sit in the same dock. A one-line prepend can turn a clean base into an instruction-following deputy you did not ask for. Pin the template file. Diff it. If the template changed and nobody filed a ticket, you already have a supply-chain incident, even if the weights hash still matches.

On a gapped estate the stick that carries the adapter is the internet. One purpose, one stick, current scanner, checksum book. The air-gap article is the room. This paragraph is the file on the stick.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Supply Chain Risk in Open Model Weights” is a path problem. A P1 CIO/CTO should be able to name the tool, the identity, the secret and the egress that would make “model supply chain security” real. If the only control is a network diagram from last year, you have a story, not a threat model.

A weight file is software you did not compile. Receive it like software: checksum, provenance, licence, scanner, two-person copy. Hugging Face is not a gazette. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Supply Chain Risk in Open Model Weights” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “model supply chain security” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.