Implementation guide
OWASP AISVS v1.01
Supply Chain Security for Models · Model Artifact Integrity
Download models only from approved sources
Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.
OWASP AISVS v1.01, requirement 6.1.2
In plain English
Download weights, datasets and adapters only from sources you have approved, and block everything else. Public hubs let anyone upload, and attackers publish look-alike repositories with names one character away from popular ones.
What good looks like
- A written list names approved sources, down to the publisher or organisation.
- Downloads from anywhere else are blocked technically, or need a recorded exception.
- Production and build systems pull from an internal mirror and never straight from the internet.
- The list is reviewed, and each entry has an owner.
How teams usually do it
- An internal model and dataset registry or proxy that mirrors approved repositories only. Artifact managers such as Artifactory and Nexus can proxy Hugging Face.
- Network egress rules on training and serving environments that block direct access to public hubs.
- Pinning each approved repository to a specific revision hash.
Suggested evidence
- The approved source list.
- Proxy and egress configuration.
- A test showing a download from an unapproved source is refused.
Common mistakes
- Approving a whole hosting site when anyone can upload to it. Approve named publishers.
- Trusting a repository because it has many downloads or a familiar-looking name.
- Developers downloading to laptops and copying files in by hand, round the proxy.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.