Supply Chain Vulnerabilities in Preprocessing Tools
前處理工具供應鏈漏洞
Design & Development
Risk Description
When an attacker uploads a specially crafted file to an organization's processing service, triggering a vulnerability in a preprocessing library; due to unmitigated control gaps, the system is compromised before inference even begins, triggering external stakeholder impacts and causing the organization's defenses focus on the model layer and do not cover the preprocessing stage.
Framework Mappings
OWASP Top 10 for LLMLLM03
MITRE ATLASAML.T0010
NIST CSF 2.0PR.PS
ISO/IEC 42001Annex A.10.3
ISO/IEC 5338設計與開發
Risk Treatment & Implementation Guidance
Sandbox preprocessing, deploying file parsing separately from model inference; Security-audit preprocessing libraries and include them in vulnerability management; Validate upload formats and content, intercepting anomalous files before the sandbox