Supply-chain threats no longer pertain solely to enterprise software. In the world of on-device LLMs, hardware, firmware, model packaging, and even manufacturing processes are all potential vectors for compromise.
Pre-trained models are widely adopted for their ability to accelerate AI deployments and reduce development costs. However, this convenience comes at a hidden price: they introduce vulnerabilities that can silently compromise entire systems. Whether sourced from reputable repositories or lesser-known vendors, these models can harbour biases, backdoors, or outright malicious behaviours—threats that are difficult to detect and even harder to mitigate post-deployment.