Beyond Detection: A Recovery-Oriented Architecture for Compromised AI Model Remediation
AI supply chain security has matured at the point of adoption. Model signing, provenance documentation and static scanning all answer whether an artifact is what it claims to be. None of them answers the question that arises when that trust is later overturned: given an artifact now known to be compromised, which deployed models descend from it, and what can be done about each one?
The paper argues this is a graph reachability problem rather than a cryptographic one, gives a formal model of how compromise propagates across a typed lineage graph, and builds a recovery planner that classifies every affected artifact by whether rollback to a clean, signed ancestor is actually available.
- Two proofs. A blast radius computed over an incompletely recorded graph is a sound lower bound on true exposure, so the query never over-reports. Any rollback target the planner proposes lies outside the true blast radius, even though the planner never sees that graph.
- Partial records mislead in a measurable way. The rate at which artifacts are wrongly declared unrecoverable grows superlinearly in the detection miss rate, while the count grows sublinearly. Claims about operational cost are claims about the count, not the rate.
- Attestation coverage is a poor security metric. An adversary who withholds attestations near the compromise, rather than losing them at random, halves recall at an identical recording budget.