Poisoned Pickles Make You Ill
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 14:30· Room 0D-2-0D-3 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Pickle files for ML models are trivially weaponisable because they execute arbitrary Python on load; the session shows a concrete exploit that modifies a scikit learn model’s __reduce__ behavior to dump environment secrets and then demonstrates serving with mlserver where an unsigned or poisoned pickle runs but a signed, attested artifact fails to load. Tools shown include scikit learn model poisoning, mlserver inference with artifact verification, and mitigation options like ONNX or reduced-feature pickle libraries and signing plus attestations.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:05Security in ML overlooked
- 2:09Python pickles and risks
- 3:54Pickle poisoning vulnerabilities
- 8:10Pickle limitations
- 9:14ML deployment architecture
- 10:56Live demo: poisoning pickle model
- 13:24Exploiting pickle vulnerabilities
- 14:08Mitigating risks with Scopes
- 15:31Real-world poisoning case
- 16:56DevOps for ML security
- 18:19ML supply chain security
- 20:26Sigstore for ML signing
- 24:24Live demo: signing models
- 26:52Verifying signatures in production
- 29:00Next steps for ML security
related talks
32mPoisoned Pickles Make You Ill
27mPoisoned Pickles Make You Ill
39mDeath by (Python) Pickle: "Betrayal ML"
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
25mSecure ML: Automated Security Best Practices in Machine Learning
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...
21mEnd-to-end secure ML Development
32mFuture Open Source LLM Kill Chains