Code Signing & AI Supply Chain Security Interview Questions

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

You can check the file and test the behaviour; you cannot prove a negative. The scored answer separates code-level threats from learned backdoors and is honest about what testing can find.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Open weights arrive with code, configs, licences and unknown training. The scored answer turns due diligence into a repeatable gate that production enforces automatically.

Pinning a version is not pinning content. The scored answer verifies every file against a recorded hash, treats unexpected and missing files as failures, and explains where the lockfile's own trust comes from.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

Scraped data changes under you and anyone can write to the web. The scored answer snapshots and hashes what was collected, records where it came from, filters what it can, and keeps enough lineage to undo a mistake.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.

If two independent builds from the same source produce identical bytes, a compromised build server cannot hide. The scored answer explains how, what breaks reproducibility, and why ML needs provenance instead of bit-for-bit equality.

A model update can quietly undo controls you rely on. The scored answer runs a fixed security suite with thresholds agreed in advance, checks the artefact too, and decides what blocks a release.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Scanners are good at one thing: spotting code where only data should be. The scored answer explains how they work, how they are evaded, and why a clean scan is not a clean model.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

Signed software outlives the certificate that signed it. The scored answer explains how a timestamp proves the signature was made while the certificate was valid, and how revocation dates interact with it.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.

Shai-Hulud showed that a stolen publishing token can turn one compromised maintainer into hundreds of poisoned packages within hours. The response is part incident handling, part credential hygiene, and the prevention lives in your CI.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

Review a release whose source scan, IaC plan and dependency inventory refer to different inputs. Build a gate that distinguishes completed jobs from evidence about the actual artifact.