Journal article
Two Supply Chains, One Artifact: Why Format Safety, Signing and Backdoor Detection Do Not Compose Into an Integrity Claim About a Model
A model downloaded from a public hub is the target of two distinct defensive programmes that use the same vocabulary and secure different things. One treats the artifact as an executable: it scans serialized files for dangerous deserialization opcodes, migrates the ecosystem to code-free tensor…