Back to Catalog
Owasp Llm
top10_2025
LLM03 - Supply Chain Vulnerabilities
Risks from compromised third-party datasets, models, plugins, or libraries.
Intent & Description
'
🎯 Intent
Secure the LLM application supply chain including models, datasets, plugins, and dependencies.
📋 Context
LLM applications depend on pre-trained models, fine-tuning datasets, plugins, and third-party libraries. Any compromised component can introduce backdoors or vulnerabilities.
💡 Solution
Vet model providers and data sources. Verify model checksums. Audit plugins and extensions. Use model scanning tools. Maintain an inventory of all AI components. Apply least privilege to plugin access.'
Real-world Use Case
Use when selecting models, integrating third-party plugins, or sourcing training datasets for LLM applications.
📌 TL;DR
Secure your AI supply chain. Vet models and data sources, verify integrity, audit plugins, track all AI components.
Advantages
- Prevents model backdoors
- Protects against poisoned datasets
- Reduces plugin attack surface
- Enables component tracking
Disadvantages
- Model provenance is often opaque
- Auditing large models is challenging
- Plugin ecosystems evolve rapidly