Microsoft and NVIDIA: open-weight AI shifts security burden to enterprises

Microsoft and NVIDIA published joint guidance warning that organizations running open-weight models on their own infrastructure must supply safety and security controls normally handled by the provider. The paper sorts risks into five categories and 30 types and recommends cryptographic signing of model files plus layered controls.

• Guidance splits open-weight model risks into 5 categories and 30 types
• Cryptographic signing recommended to verify model file provenance
• BadEngram attack alters ~0.02% of parameters to plant a lasting backdoor
• Pickle format can execute arbitrary code when loading untrusted models