LiteLLM Supply Chain attacks: When Trusted Software Becomes a threat.

Artificial intelligence has become everyday part of our lives. Many applications today use Large Language Models(LLM) such as ChatGPT, Claude, or Gemini and many more AI models to generate text and answer our questions, or to even automate our tasks.

But there is another side to AI that people do not usually see that is, its Security.

The type of security problem that can affect AI applications and disrupt organisations is a software supply supply chain attack. To understand how this could affect tools such as LiteLLM, we first need to know what does a supply chain attack actually means.

What is a Supply-Chain Attack ?

Imagine you buy a product from a company you trust. But also imagine a situation where a component of that product contains something that's supplied by a company which produces fake replica components. If that has been supplied to customers without knowing that it has been modified it could affect the customers and whole company.

Software works in a similar way.

Modern applications do not consist of code that is entirely written by their developers. They use packages, libraries, and other third party components. If one of those components is compromised, malicious code can potentially reach the other applications that depend on it.

That is called a software supply chain-attack.

What is LiteLLM ?

LiteLLM is a software library that makes it easier for applications to communicate with different Large Language Model providers through a common interface. Instead of an application having to implement different methods for communicating with every AI provider, tools like LiteLLM could simplify that process.

This makes it useful- but it also means that security of the software and its dependencies matters.

How Could a Supply-Chain Attack Affect an LLM Application ?

The basic idea can be explained like this: Developer → Software Package → Application → User

Now imagine an attacker compromises a package somewhere in that chain: Attacker → Compromised Package → Application → User.

The application developer may not even realize that something has been changed. If the compromised component is installed or updated, malicious code potentially run as part of the application.

The important point is that the attacker does not necessarily have to attack the AI model. Instead, they can target the software surrounding the AI model.

Why is this Dangerous ?

LLM applications have the ability to connect several components to together:

• AI Models
• Software libraries
• APIs
• Databases
• Cloud Services
• Authentication systems

A weakness in one part of this chain can affect the security of the entire application. If an attacker compromises a dependency that an AI application trusts, the attacker maybe able to execute unwanted code, steal sensitive information or even could interfere with the application's operation depending on the permissions and environment available to that software.

That's why simply choosing a trusted AI provider is not enough. The software used to access the AI provider also needs to be trusted and maintained securely.

How can Organizations Reduce the Risk ?

There is no single perfect solution, but several practices can reduce the impact and make supply-chain attacks much harder:

1.Pin and verify dependencies

• Organizations should carefully control which versions of software packages are installed rather than automatically accepting every new version.

2. Monitor Dependencies

• Software dependencies should be regularly checked for vulnerabilities, suspicious changes, and security advisories.

3. Protect Secrets

• API keys, passwords, and other credentials should not be stored directly in source code and should have limited permissions.

4. Use Least Privilege

• A library should only have the permissions it actually needs. If something is compromised, this limits what an attacker can do.

5. Review Software before deploying it

• Organizations should understand what third-party software is being used into their environment instead of blindly trusting every package.

Conclusion

LLM security is not only about protecting the AI model. The applications using AI are built from many different pieces, inlcuding third-party libraries and dependencies. This creates a software supply chain, and every part of that chain can become a potential security concern.

LiteLLM is an example of software that can sit between an application and different LLM providers. Therefore, like any other important software depenedency, it needs to be managed and secured carefully.