Garth Mollet, Senior Principal Product Security Engineer and Technical Advisor for Product Security at Red Hat, joins host Robert Blumen for a discussion of AI supply chain security. They start with the basics of supply chain security, including the key components of the AI supply chain, and how it differs from the conventional software supply chain. Garth discusses whether the attacks target model weights or inference, and describes the most common attacks and what’s in it for the attacker, whether exfiltration, credentials, sabotage, or resources. The episode also considers SPIFFE, SPIRE, attestation, workload identity, and whether AI has the equivalent of “reproducible builds.”
Brought to you by IEEE Computer Society and IEEE Software magazine.
Show Notes #
Related Episodes
[SE Radio 606: Charlie Jones on Third-Party Software Supply Chain Risks](https://se-radio.net/2024/03/se-radio-606-charlie-jones-on-third-party-software-supply-chain-risks/) -
[SE Radio 575: Nir Valtman on Pipelineless Security](https://se-radio.net/2023/08/se-radio-575-nir-valtman-on-pipelineless-security/) -
[SE Radio 541: Jordan Harband and Donald Fischer on Securing the Supply Chain](https://se-radio.net/2022/12/episode-541-jordan-harband-and-donald-fischer-on-securing-the-supply-chain/) -
[SE Radio 535: Dan Lorenc on Supply Chain Attacks](https://se-radio.net/2022/10/episode-535-dan-lorenc-on-supply-chain-attacks/) -
[SE Radio 630: Luis Rodriguez on the SSH Backdoor Attack](https://se-radio.net/2024/08/se-radio-630-luis-rodriguez-on-the-ssh-backdoor-attack/)
AI/ML Security
[SE Radio 680: Luke Hinds on Privacy and Security of AI Coding Assistants](https://se-radio.net/2025/08/se-radio-680-luke-hinds-on-privacy-and-security-of-ai-coding-assistants/) -
[SE Radio 395: Katharine Jarmul on Security and Privacy in Machine Learning](https://se-radio.net/2020/01/episode-395-katharine-jarmul-on-security-and-privacy-in-machine-learning/)
Container Security