SLSA Framework

SLSA defines a progressive maturity model with four distinct levels, each building on the security guarantees of the previous tier:

• Level 1: Requires a fully scripted, automated build process with provenance generation showing how the artifact was built.
• Level 2: Demands version control and a hosted build service that generates authenticated provenance, preventing post-build tampering.
• Level 3: Enforces hermetic builds and isolated, ephemeral build environments where the source is verified against a trusted policy.
• Level 4: Requires two-person review of all changes and a fully reproducible build process, offering the highest degree of non-tamperability.

The central artifact of the SLSA framework is a verifiable, in-toto provenance attestation. This cryptographically signed metadata document records the builder, the source repository, the build recipe, and all input materials. It creates an unbroken chain of custody, allowing a verifier to answer the critical question: 'Was this artifact built from the correct source code on a trusted platform?' This shifts trust from the artifact itself to the verifiable record of its creation.

SLSA directly addresses critical supply chain attack vectors that compromise software integrity before deployment:

• Source Tampering: Unauthorized modification of source code after a review has been completed.
• Build Compromise: A compromised build platform injecting malicious behavior during the compilation or packaging step.
• Artifact Tampering: Modification of a built package after it has been produced but before it is consumed by the end user.
• Dependency Confusion: Substituting a private, internal dependency with a malicious public package of the same name.

Applying SLSA to AI extends its scope beyond code to include model weights, datasets, and training pipelines. A SLSA-compliant AI supply chain generates provenance that attests to the exact dataset version, hyperparameters, and training code used to produce a model. This prevents model poisoning and ensures that a deployed model is a faithful artifact of a known, audited process, not a tampered or backdoored version.

SLSA is not just a build-time framework; it is enforced at deploy time by a policy engine. Before a container image or AI model is allowed to run in production, a policy engine like Binary Authorization validates the SLSA provenance against a set of organizational rules. For example, a policy might require that all production artifacts originate from a specific CI/CD system and reach at least SLSA Level 3, automatically blocking any artifact that fails this cryptographic check.