The model nobody signed Start this lab

Why this matters

A model is executable content that most pipelines treat as data. Weights pulled from a mirror, unsigned and stored in a pickle-backed format, are a code-execution path into serving — and the fastest way to inherit somebody else's backdoor.

Concepts

Objectives graded

• Trace where a model artifact actually came from
• Test integrity against the recorded digest instead of the file name
• Explain why a pickle-backed weight file is a containment decision by itself
• Contain the serving node without stopping the build pipeline

MITRE ATT&CK coverage

An unsigned model artifact from an external mirror, loaded into serving: software supply chain compromise with the payload inside the weights.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• Provenance was read from the registry on the host rather than taken from the release note.

  investigation · weight 15 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• The offending version was identified from the pull log, not from the changelog.

  investigation · weight 10 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• The out-of-policy source was named, so the supply chain gap is specific.

  investigation · weight 10 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• Integrity was tested against the recorded digest rather than assumed from the file name.

  explanation · weight 10 · T1554 Compromise Host Software Binary (Persistence)

• The format risk was named, so the decision holds even if the digest had matched.

  configuration · weight 10 · T1554 Compromise Host Software Binary (Persistence)

• The serving node running the unverified artifact was contained under approval.

  safety · weight 20 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

Common mistakes

• Treating a matching file name as identity.
• Accepting a community mirror because the internal registry was slow.
• Loading the artifact to inspect it.
• Isolating the build pipeline and leaving the serving node answering traffic.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.