ShadowPickle: Stealthy Pickle Deserialization Attacks Evade ML Model Scanners and Hubs
Researchers introduce ShadowPickle, a set of three novel pickle deserialization attacks that evade detection by ten state-of-the-art model scanners and four major model hubs, including Hugging Face. These attacks exploit the Pickle VM's external module import mechanism to execute malicious payloads during model deserialization. ShadowPickle achieves up to 63% evasion rates and up to 50% higher evasion rates than previous attacks, exposing significant weaknesses in current model scanning defenses.
Why it matters: This work reveals critical security vulnerabilities in widely used machine learning model hubs, raising concerns about supply chain attacks and the safety of shared pre-trained models.
Full story at: arXiv Cryptography and Security ↗