Skip to content

Identifying the Supply Chain of AI for Trustworthiness and Risk Management in Critical Applications

🕒 Published (v1): 2025-11-19 14:52 UTC · Source: Arxiv · Venue: AAAI · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This position/survey paper identifies a systematic gap in AI risk management: existing frameworks treat AI systems as monolithic rather than as compositional supply chains involving data, models, programs, and infrastructure. The authors propose a lightweight taxonomy of AI supply chain entities and roles to help stakeholders—including non-AI-experts—inventory dependencies and apply governance controls to agentic and other AI systems used in critical applications.

Problem

Current AI risk frameworks (NIST AI RMF, ISO 42001, Australian Voluntary AI Safety Standard) address risk for a single entity using a single system but lack structured vocabulary for the complex, recursive dependency web of modern AI systems. Existing software supply chain tools (SPDX, CycloneDX, SBOM efforts) cover provenance and cybersecurity for models/training data but not the broader runtime dependency graph—especially the data sources, retrieval corpora, agent sub-components, and hosted services that influence outputs at inference time. This gap is acute for agentic LLM systems deployed in critical domains (healthcare, law, utilities) where stakeholders often cannot trace what contributed to an output.

Method

The authors conduct a survey of existing AI risk and supply chain frameworks, then propose a four-component taxonomy of AI supply chain entities:

  • Data: roles of creator, aggregator, host, user — covering training datasets, RLHF feedback, RAG corpora, and internet sources accessed by agentic systems at runtime.
  • Models: roles of creator, host, user — encompassing foundational models, fine-tuning adapters (e.g., LoRA), and domain-specific sub-models.
  • Programs: roles of developer, host, integrator, user — covering all engineered (non-learned) code: inference wrappers, retrieval systems, agent orchestration logic, training pipelines.
  • Infrastructure: roles of developer, host, integrator, user — hardware, CUDA platforms, networking, storage, and security systems.

Entities can hold multiple roles across components; roles can be shared by multiple entities. The taxonomy is deliberately coarse-grained to remain actionable for stakeholders without deep AI expertise, mapping to "who to ask" rather than full technical auditing.

Key Contributions

  • Taxonomy of four AI supply chain components (data, models, programs, infrastructure) each with defined stakeholder roles, extending prior work beyond model provenance to runtime data sources and agentic behaviors.
  • Explicit inclusion of agentic and RAG system dependencies (runtime data hosts, agent sub-components, system prompts) as first-class supply chain entities.
  • Bridging vocabulary between AI-proficient developers and non-expert end-users in critical applications, enabling application of existing frameworks (NIST AI RMF, SPDX/CycloneDX, Model Cards) to identified gaps.
  • Identification of AI-specific supply chain risks not covered by traditional software SCM: e.g., split-view data poisoning (Carlini et al. 2024), frontrunning data poisoning, model collapse from synthetic data (Shumailov et al. 2024), and silent model fallback without user notification.

Results

No empirical experiments or benchmark numbers are reported. The paper is a position/survey paper. Evidence is illustrative: case studies in legal AI failures (Green et al. 2025), a hypothetical hospital chatbot with agentic RAG capabilities, and a hypothetical LLM meeting summarization system are used to demonstrate where the taxonomy surfaces non-obvious risks.

Limitations

  • No empirical validation of the taxonomy's effectiveness or completeness in real deployments.
  • Taxonomy is explicitly "lightweight" and trades coverage depth for accessibility; may miss fine-grained distinctions needed for formal auditing.
  • Does not address risks from algorithmic bias, model architecture choices, or hyperparameter selection except where they interact with supply chain visibility.
  • Does not yet cover multi-agent system topologies in detail; the referenced TAIBOM project similarly scopes to single-instance networks at time of writing.
  • Future work needed to evaluate whether the taxonomy meaningfully improves end-user adoption of governance frameworks.

Relevance to Agentic AI / LLM Agents

Agentic LLM systems are a primary motivating case for this work: the paper explicitly calls out that agentic capabilities expand the supply chain at runtime by pulling in external data hosts, APIs, and tool endpoints that may not be visible to the deploying organization. The taxonomy directly classifies agent sub-components (retrieval systems, orchestration logic, system prompts) across the Program and Data components, and highlights that agentic systems are particularly vulnerable to data-quality and data-poisoning risks because they autonomously query data hosts without human mediation. For researchers building or deploying LLM agents in critical applications, this framework provides vocabulary for articulating dependency risk—especially the interaction effects between multiple models, agents, and live data sources that compound in non-obvious ways.