Title: Quiz 10 — Model Provenance and AI Supply-Chain Security
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 10 — Model Provenance and AI Supply-Chain Security

Q: A pickle-format model file can execute arbitrary code the moment it is loaded/deserialized.
- True
- False
A: True

Q: What does the safetensors format store that makes it safer than pickle for model weights?
- Only tensor data, with no executable code
- Encrypted tensor data
- A compressed version of the pickle format
- Model weights plus a signed certificate
A: Only tensor data, with no executable code

Q: A model card provides cryptographic proof of a model's origin and integrity.
- True
- False
A: False

Q: Name the three components of the Sigstore toolchain used for keyless signing of artifacts (including, per the OpenSSF Model Signing SIG, model weights).
Feedback: Sample/expected answer: Cosign, Fulcio, and Rekor

Q: What is the primary role of Rekor in the Sigstore stack?
- It issues short-lived certificates from an OIDC identity
- It is a public, tamper-evident transparency log recording signing events
- It compiles the model into a signed binary
- It converts pickle files to safetensors
A: It is a public, tamper-evident transparency log recording signing events

Q: Because a model has hundreds of thousands of downloads on a public hub, it can be assumed to have passed a formal security audit.
- True
- False
A: False

Q: What does ML-BOM (or AI-BOM) add to a traditional SBOM, according to CycloneDX's extension?
Feedback: Sample/expected answer: Enumeration of base models, training/fine-tuning datasets, evaluation benchmarks, and their dependencies (in addition to standard software components)

Q: Under OWASP's LLM Top 10, third-party models, datasets, adapters, and plugins are classified as which risk category?
- LLM01 — Prompt Injection
- LLM03 — Supply Chain Vulnerabilities
- LLM06 — Sensitive Information Disclosure
- LLM09 — Overreliance
A: LLM03 — Supply Chain Vulnerabilities