Research prototype accompanying the IEEE Connect 2026 paper:
"Update Instability Score: Structural Validation for Secure AI Supply Chains"
Modern AI supply chains distribute pretrained model weights across teams, vendors, and deployment environments. Standard validation — accuracy testing — fails to detect malicious parameter perturbations that preserve performance metrics while introducing behavioral instability.
This repository introduces two contributions:
| Contribution | Description |
|---|---|
| AMUP | Adversarial Model Update Poisoning — a threat model for covert weight-level attacks on AI supply chains |
| UIS | Update Instability Score — a lightweight detection metric requiring no labeled data, retraining, or architectural access |
Key result: >100× separation between benign and malicious updates at equal accuracy on CIFAR-10 and STL-10.
Traditional supply chain attacks modify model behavior detectably — accuracy drops, outputs shift. AMUP models an adversary who:
- Perturbs model parameters within a carefully bounded region
- Preserves task accuracy on standard evaluation sets
- Introduces latent behavioral instability that activates under specific conditions
This makes AMUP-style attacks invisible to accuracy-based validation pipelines.
UIS detects AMUP-style attacks by measuring structural instability in parameter updates rather than output behavior.
Properties:
- No labeled data required
- No retraining required
- No architectural access required
- Operates purely on parameter delta statistics
| Dataset | Benign UIS | Malicious UIS | Separation |
|---|---|---|---|
| CIFAR-10 | baseline | >100× | ✅ |
| STL-10 | baseline | >100× | ✅ |
Both datasets evaluated at equal task accuracy between benign and poisoned models.
AMUP_AI_SupplyChainSecurity/
├── notebooks/ # Experiment notebooks
├── src/ # UIS implementation
├── results/ # Evaluation outputs
└── README.md
Paper accepted at IEEE Connect 2026. DOI forthcoming (expected September 2026).
If you use this work, please cite once the DOI is available.
This is a research prototype demonstrating a threat model and detection metric. It is not intended for production deployment. The AMUP threat model is documented for defensive research purposes.