Every deployed model is just an array of weight numbers. A supply-chain tampering attack silently substitutes a few of those numbers — a poisoned checkpoint, a compromised model registry, a trojaned artifact in the CI/CD pipeline — hoping nobody notices before it reaches production.
The defense here is a block-level rolling checksum, the same idea behind model signing (Sigstore/cosign for ML) and Merkle-tree integrity proofs. At deployment the network's weights are split into fixed-size blocks and each block is hashed:
h_0 = 0
h_i = (h_i-1 * 31 + q(w_i)) mod (2^31 - 1)
q(w) = round(w * 1000) // quantize float weight
digest(block) = h_n // stored as the block's signature
On every verification sweep the digest is recomputed from the current weights and compared to the signed value. A single altered weight — even by a tiny amount — cascades through the polynomial hash and flips the digest, so any tamper anywhere in a block is caught. On a match the block's shield turns green; on a mismatch it turns red, the block is quarantined and rolled back to its signed values, and the event is logged with its detection latency.
- Tamper attack rate — how often the "attacker" mutates a random weight (simulating a compromised artifact).
- Checksum block size — the granularity trade-off: small blocks localize tampering precisely but need more digests to store and verify; large blocks are cheap but a single corrupted weight taints the whole block until the next sweep.
- Verification interval — how often digests are re-checked. Shorter intervals catch tampering faster (lower mean detect latency) at the cost of more compute — the same trade-off real MLOps pipelines make between continuous attestation and periodic audits.
- Signing OFF — turns off verification entirely. Tampered weights are never re-checked, so corruption accumulates invisibly and is counted as silent corruption instead of a detected event — this is the blind spot an unsigned model supply chain leaves open.
Real-world relevance: this is the same principle behind SBOM-for-AI, model cards with cryptographic hashes, and MLOps pipelines that reject any artifact whose signature doesn't match before it's ever loaded into a serving container.