5 papers · 1 filter
FuseChain: Runtime Evidence Reconstruction for Software Supply-Chain Attacks
Zhuoran Tan, Yutian Tang, Jeremy Singer +2
Software supply-chain (SSC) attacks are increasingly multi-stage, cross-source, and temporally distributed. A single attack campaign may leave weak and fragmented traces across mul…
Attesting LLM Pipelines: Enforcing Verifiable Training and Release Claims
Zhuoran Tan, Jeremy Singer, Christos Anagnostopoulos
Modern Large Language Model (LLM) systems are assembled from third-party artifacts such as pre-trained weights, fine-tuning adapters, datasets, dependency packages, and container i…
An Empirical Study of Observability Limits in Advanced Software Supply Chain Attacks
Zhuoran Tan, Wenbo Guo, Jiewen Luo +3
Advanced software supply chain (SSC) attacks are increasingly runtime-only and leave fragmented evidence across hosts, services, and build/dependency layers, making any single tele…
Operational Runtime Behavior Mining for Open-Source Supply Chain Security
Zhuoran Tan, Ke Xiao, Jeremy Singer +1
Open-source software (OSS) is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source cod…
MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools
Zhuoran Tan, Run Hao, Jeremy Singer +2
Tool-augmented Large Language Model (LLM) agents create a new supply-chain surface: Model Context Protocol (MCP) tools are installed like third-party packages, yet their outputs ca…