The rapid adoption of Artificial Intelligence (AI) in edge environments has accelerated the use of Function-as-a-Service (FaaS) serverless platforms for deploying workloads across the cloud-edge continuum. However, this architectural shift introduces critical security vulnerabilities either at individual clusters or in multi-cluster continuum systems. The AI functions frequently integrate unvetted open-source libraries, creating a supply-chain attack surface, where malicious dependencies can execute undetected inside short-lived containers and compromise those AI functions. Traditional static analysis often fails to uncover these dynamic threats, necessitating robust runtime analysis. To address these issues, we present a comprehensive evaluation of learning-based approaches for identifying compromised functions by analyzing the behaviors of system calls. Moreover, we generate a dataset of 1.6 million system calls from 30 different serverless functions deployed on an OpenFaaS-Kubernetes testbed, which is available to the community for benchmarking. Our systematic analysis and comparison of five learning-based detection methods across multiple feature representations provide further insights into the identification of compromised functions. Our results demonstrate that runtime system call analysis can effectively identify supply-chain compromises, achieving detection rates up to 100% with F1 scores of 99.90%, without requiring application or platform modifications.