一句话：提出证明感知的晋升门禁，在制品进入训练与部署前验证声明证据并强制安全策略，以缓解 LLM 供应链风险。
现代 LLM 系统由第三方制品（预训练权重、微调适配器、数据集、依赖包、容器镜像）经自动化流水线组装而成，随之带来供应链风险：被污染的依赖、恶意 hub 制品与不安全反序列化、伪造来源以及后门模型。核心缺口在于，训练与发布声明（数据与代码谱系、构建环境、安全扫描结果等）很少与其描述的制品做密码学绑定，导致跨团队、跨阶段的执行不一致。作者提出「证明感知的晋升门禁」：在制品被准入可信环境（训练、微调、部署）之前，门禁验证声明证据、执行安全加载与静态扫描策略，并施加默认安全的部署约束；在组织已有运行时安全工具时，同一门禁可通过插件可选地摄入标准化动态信号，以降低高风险制品的不确定性。论文给出实用的「声明—控制」映射与评估蓝图，借助代表性供应链场景与运维指标（覆盖率与决策）为后续完整研究论文铺路。
Modern Large Language Model(LLM) systems are assembled from third-party artifacts—pre-trained weights, fine-tuning adapters, datasets, dependency packages, and container images—fetched through automated pipelines. This speed comes with supply-chain risks: compromised dependencies, malicious hub artifacts and unsafe deserialization, forged provenance, and backdoored models. A core gap is that training and release claims (e.g., data and code lineage, build environment, and security scanning results) are rarely cryptographically bound to the artifacts they describe, making enforcement inconsistent across teams and stages. We propose an attestation-aware promotion gate: before an artifact is admitted into trusted environments (training, fine-tuning, deployment), the gate verifies claim evidence, enforces safe-loading and static scanning policies, and applies secure-by-default deployment constraints. When organizations operate runtime security tooling, the same gate can optionally ingest standardized dynamic signals via plug-ins to reduce uncertainty for high-risk artifacts. We outline a practical claims-to-controls mapping and an evaluation blueprint using representative supply-chain scenarios and operational metrics (coverage, and decisions), charting a path toward a full research paper.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2603-28988,
title = {Attesting LLM Pipelines: Enforcing Verifiable Training and Release Claims},
author = {Zhuoran Tan and Jeremy Singer and Christos Anagnostopoulos},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805530}
}