AI security lab · Supply Chain Attacks

Shadow Model Substitution

In production ML systems, the deployed model can be silently replaced with a shadow model that behaves identically on benchmarks but introduces subtle biases or backdoors in production traffic. **Challenge:** A model serving infrastructure loads models from a shared storage bucket. Demonstrate how an attacker with storage access can substitute the production model with a shadow model that passes all health checks but behaves maliciously on specific inputs.