Every AI system is assembled from parts you didn't make: base models, datasets, adapters, and packages pulled from public hubs. Each is a place to hide an attack. In these labs you catch a model that runs code the moment you load it, and you walk a signing-and-provenance chain to find the one poisoned link before it ships. The artifacts and registries here are simulated.
sentiment-pro.bin — 240k downloads, great benchmarks, uploaded by a community account last week. It ships as a pickle. You're about to torch.load() it on a build server with production credentials.Task: before you trust it, scan the file. Then choose how to handle it so no attacker code can run.
REDUCE opcode that calls os.system on load — nothing to do with the model's weights. Loading with safetensors (a data-only format with no code path) or rejecting the artifact both keep the attacker's code from ever executing. The lesson: never torch.load a pickle from an untrusted source; prefer safetensors and scan artifacts before they touch a build machine.Task: verify the chain, identify the component that fails verification, quarantine it, and only then ship. Promote a chain with a broken link and you ship the compromise.
tone-adapter-community: unsigned, with no SLSA provenance and a publisher that didn't match. Quarantining it and shipping only the verified components is exactly what provenance is for — it turns "we think this is fine" into "we can prove each part came from who it claims, unaltered". A single unverified LoRA adapter is all it takes to backdoor a model; the signature is what stops it at the gate.llama-guard safety model. Your resolver found three packages that answer to that name across registries. Only one is the real vendor release.Task: read the details and pull the legitimate package. Publisher, namespace, spelling, signature, and a too-good version are your tells.
@meta/llama-guard, in the vendor's scoped namespace, signed, with a version that matches the real release. The other two were traps — llama-gaurd is a typosquat (one transposed letter, look-alike publisher), and the unscoped llama-guard v9.9.9 is dependency confusion: an unsigned public package with an inflated version to beat your resolver. The defenses are pinning, scoped/private registries, and verifying the publisher and signature — never the name alone.Create a free account to bank your Guild Marks, climb the public leaderboard, and take on the full track.