Search papers, labs, and topics across Lattice.
This paper introduces SHADOWPICKLE, a novel set of stealthy pickle deserialization attacks that exploit vulnerabilities in pre-trained machine learning models (PTMs) hosted on model hubs, enabling remote code execution. The attacks utilize the Pickle Virtual Machine's external module import mechanism to execute malicious payloads while evading detection by state-of-the-art model scanners. Evaluation results reveal that SHADOWPICKLE achieves a 63% evasion rate across ten scanners and four model hubs, significantly outperforming existing methods and underscoring the urgent need for enhanced security measures in model hosting environments.
SHADOWPICKLE can bypass ten state-of-the-art model scanners, revealing critical vulnerabilities in the current security landscape of machine learning model hubs.
Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during deserialization. Additionally, we provide PICKLEBENCH, a dynamic and extensible benchmark for automatically injecting SHADOWPICKLE into arbitrary benign PTM models. Our evaluation shows that SHADOWPICKLE evades ten SOTA scanners, and four model hubs. SHADOWPICKLE (Overwritten) has a 63% evasion rate across scanners, and up to 50% higher evasion rates than existing attacks. Besides, PICKLEBENCH is up to 25.6% more challenging than three SOTA benchmarks. Finally, we provide security recommendations for mitigating our attacks and improving the effectiveness of existing scanners. Our findings highlight the limitations of existing PTM scanners and suggest directions for improvements.
