Beyond the Basics: Hacking and Securing Machine Learning Systems and Environments
summary
Shows that loading untrusted model files can run code and deliver a reverse shell by embedding a pickle payload that triggers on load (examples use torch.load and standard pickle load calls), demonstrates simple payload-generation and a callback to an attacker IP, and warns that permissive IAM roles let a compromised notebook escalate in the cloud. Recommends network isolation, disabling outbound access, using a restricted unpickler, caching to mitigate DoS instead of blind autoscaling, and notes risks like membership inference and model extraction.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker background
- 4:22What is an inference endpoint
- 8:20Attack chain on ML systems
- 12:58Generating malicious ML payloads
- 16:36Securing file loading in ML
- 18:22Network isolation for ML security
- 19:47IAM roles and least privilege
- 20:08Securing large language models
- 23:42Top 10 attacks on LLMs
- 26:10Data and model privacy attacks
- 27:50Self-hosted LLM security concerns
- 33:00Prompt injection risks and defenses
- 36:00Q&A and closing remarks
related talks
43mHacking and Securing ML Systems and Environments
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...
56mHidden Risks in Open-Source Code and AI Models
21mEnd-to-end secure ML Development
25mSecure ML: Automated Security Best Practices in Machine Learning
53mSecurity of Machine Learning Systems
39mDeath by (Python) Pickle: "Betrayal ML"
50mMalice In Chains: Supply Chain Attacks Using Machine Learning Models