Malice In Chains: Supply Chain Attacks Using Machine Learning Models
summary
Model serialization routinely enables remote code execution through pickle arbitrary code execution and similar marshal/HDF5 flows, with hundreds of exploitable Python functions identified and real Cobalt Strike beacons found embedded. A 250 line toolkit demonstrates in minutes how to hide a payload via stealthy steganography embedding 900 KB across tensors and a conversion bot on Hugging Face runs torch.load unsafely enabling a Hugging Face conversion bot compromise that exfiltrates tokens; a PoC Quantum ransomware executes in seconds.
AI-written summary · about
chapters (18)
- 0:00AI supply chain attacks
- 1:31Supply chain attacks with AI
- 6:04Vulnerable AI supply chain points
- 7:31ML serialization formats overview
- 8:35Exploiting Python pickle format
- 13:54Pickle code execution in PyTorch
- 14:17Caras models Lambda injection
- 18:09TensorFlow graph mode exploits
- 22:01ONNX and model format flaws
- 23:47Malware in model tensors
- 29:32Ransomware in PyTorch model
- 33:54SafeTensors service compromise
- 37:25ClearML package attack chain
- 38:28Malicious PyTorch package
- 39:54Hugging Face typosquatting
- 41:21AI platform security progress
- 43:07Security in machine learning
- 45:35Q&A on model integrity
related talks
46mInsane in the Supply Chain: Threat modeling for...
32mFuture Open Source LLM Kill Chains
45mThe Dark Side of AI: The Hidden Supply Chain Risks in Open...
56mHidden Risks in Open-Source Code and AI Models
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
30mThe Simple, Yet Lethal, Anatomy of an AI Attack
27mTrojan Model Hubs: Hacking the ML Supply Chain & Defending Yourself from Threats