⚡ Quick Summary
Published by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD ACSC) alongside intelligence and cyber security agencies across Canada, Singapore, South Korea, Japan, New Zealand, the UK, and the US, this guide outlines critical cyber supply chain security practices for artificial intelligence and machine learning (AI/ML) ecosystems. It establishes actionable principles for evaluating and mitigating vulnerabilities across the entire AI lifecycle, addressing risks introduced by third-party data, foundation models, specialized software libraries, computing hardware, and managed vendor services.
🧩 What's Covered
The guidance establishes a structured risk assessment framework mapped to NIST’s Adversarial Machine Learning (AML) taxonomy and MITRE ATLAS:
- AI Data Integrity: Identifies threats including low-quality datasets, data poisoning, indirect prompt injection, and training data exposure (model inversion, membership inference, and data extraction). Recommended mitigations focus on data quarantining in isolated environments, automated scanning, rigorous sanitisation, provenance tracking, and data obfuscation.
- Machine Learning Model Security: Analyzes risks surrounding model serialisation exploits, model poisoning (availability, targeted, and backdoor poisoning), stegomalware embedded in model weights/metadata, and evasion attacks. Mitigations include adopting secure, non-executable, weight-only model formats, maintaining verified model registries, conducting adversarial training, deploying reproducible builds, and tracking AI Bills of Materials (AIBOMs).
- AI Software & Dependencies: Details the expanded attack surface stemming from complex open-source libraries, typosquatting, dependency tampering, and deserialization vulnerabilities leading to remote code execution. Mandates Software Bills of Materials (SBOMs), static/dynamic application security testing, and least-privilege deployment.
- Infrastructure and Hardware: Explores hardware-level risks tied to specialized accelerators, GPUs, proprietary firmware, and machine-to-machine communication protocols, prescribing signed drivers, verified boot, and network segmentation.
- Third-Party & Vendor Services: Provides vendor due diligence criteria, including cloud data residency constraints, contractual training data restrictions, vulnerability disclosure obligations, and clear shared responsibility definitions.
💡 Why it matters?
Modern enterprise AI deployment relies heavily on open-source repositories, external foundation models, and cloud-hosted pipelines. A single compromised pre-trained weight or poisoned training set can silently introduce backdoors, compromise confidentiality, or facilitate remote code execution across downstream systems. This multilateral guidance equips governance and security teams with concrete verification baselines to manage extended third-party AI risks before integration.
❓ What's Missing
While the document references high-level taxonomies and overarching security principles, it does not provide detailed mathematical thresholds for data sanitisation, benchmark metrics for model drift detection, or standardized contract clauses for enterprise procurement agreements.
👥 Best For
Cyber security engineers, AI risk officers, technology procurement teams, data privacy professionals, and system architects deploying or integrating third-party AI/ML models.
📄 Source Details
Jointly published in 2025 by ASD ACSC (Australia) in collaboration with CCCS (Canada), CSA (Singapore), NIS (Republic of Korea), NCO (Japan), NCSC-NZ (New Zealand), NCSC-UK (United Kingdom), and NSA (United States).
📝 Thanks to
Australian Signals Directorate (ASD) and partner cyber security agencies (CCCS, CSA, NIS, NCO, NCSC-NZ, NCSC-UK, NSA).
