Modern software is developed in a collaborative way, with developers choosing to use code from multiple third-party libraries rather than implement everything from scratch. This interdependent software supply chain has benefits for security, but it also comes with risks in the form of supply-chain attacks, such as the highly publicized attack on SolarWinds or the Log4Shell vulnerability.

I have done some research looking at software supply chains, both in terms of examining dependencies in open-source software and their impact on security and in terms of exploring how the same principles and protections can extend to machine learning models.