Trojan Model Hubs: Hacking the ML Supply Chain & Defending Yourself from Threats
summary
Public model hubs host over 3,000 models that would execute arbitrary code on deserialization and 41% of those evade Hub detection; up to 46% of cloud buckets storing models have misconfigurations. Model files commonly use pickle (and other formats with executable operators) enabling Model Serialization Attacks. Use ModelScan to detect malicious opcodes before deserialization, and use Sigstore cryptographic signing plus predeployment verification to detect tampering or poisoning and ensure an artifact matches the signed, scanned version.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:02Public model registries
- 6:05Model serialization attacks
- 11:02Private model registries
- 16:23Cryptographic signing with Sigstore
- 22:30Defense strategies summary
- 23:27Q&A
related talks
50mMalice In Chains: Supply Chain Attacks Using Machine Learning Models
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...
46mInsane in the Supply Chain: Threat modeling for...
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
32mFuture Open Source LLM Kill Chains
43mHacking and Securing ML Systems and Environments
56mHidden Risks in Open-Source Code and AI Models
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges