AI 组件进软件供应链：安全经验被忽视 From Adoption to Deployment: A Qualitative Study on AI Integration in Software Development Practice

精读摘要

LLM 作为 AI 组件进入现代软件系统已成趋势，但也给软件供应链带来独特的安全风险。传统软件供应链的安全考量与机制是多年教训积累而成，而 AI 组件与平台的快速普及却绕过了这些经验。研究发现，在缺乏明确指导的情况下选择与集成 AI 模型，可能让应用暴露于模型投毒等威胁之下，提醒业界：AI 供应链安全需要同等严肃的治理。 The rapid adoption of LLMs as AI components in modern software systems introduces distinct security risks to the software supply chain. While the traditional supply chain has accumulated hard-learned safeguards, the fast adoption of AI components has overlooked them. This qualitative study shows that selecting and integrating AI models without clear guidance can leave applications vulnerable to threats such as model poisoning.