{"id":4240,"date":"2025-02-10T07:31:55","date_gmt":"2025-02-10T07:31:55","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/malicious-ml-models-evade-detection-via-broken-pickle-format-on-hugging-face\/"},"modified":"2025-02-10T07:31:56","modified_gmt":"2025-02-10T07:31:56","slug":"malicious-ml-models-evade-detection-via-broken-pickle-format-on-hugging-face","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/malicious-ml-models-evade-detection-via-broken-pickle-format-on-hugging-face\/","title":{"rendered":"Malicious ML Models Evade Detection via Broken Pickle Format on Hugging Face"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Feb 08, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Artificial Intelligence \/ Supply Chain Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n    <a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiy9HRla2vCXTJvnM3vT93AmKbjqs9stovOJ537UUG3Uq_M-ZPX2Yd45EZH9mCfek0Mi11XBLVV5yZjxpHBmvUnWkaYjlRlG9ASGHpXTwjd40LkrKauR0WuaaH62q7x9en4RowtY8zBugXEBETIiT_PLPlhK8Czmz_V79IcsE5QCEE521sWAu16DrtsMn8R\/s728-rw-e365\/hugging-face-malware.png\" style=\"clear: left; display: block; float: left; text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p>    <\/a>\n  <\/div>\n<p>Cybersecurity researchers have uncovered two malicious machine learning (ML) models on Hugging Face that utilized an unusual technique of &#8220;broken&#8221; pickle files to evade detection.<\/p>\n<p>&#8220;The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning of the file,&#8221; ReversingLabs researcher Karlo Zanki <a href=\"https:\/\/www.reversinglabs.com\/blog\/rl-identifies-malware-ml-model-hosted-on-hugging-face\" rel=\"noopener nofollow\" target=\"_blank\">said<\/a> in a report shared with The Hacker News. &#8220;In both cases, the malicious payload is a typical platform-aware reverse shell that connects to a hard-coded IP address.&#8221;<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/encrypted-attacks-report-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh6e4c8i_pkXRCFnrtqVIygOrARiVnU3_KUgU5mhPl5V4uj8R1KcQOxRLdZ0xm1Rf5AX_cviUAeiiRkTJCe8HXzOeB363590NBXAMv92N9e7zr4m7aKtDq-Q_gpP9QFWecL0oxcVtmqSg9qrGEGqlDbzwNNFKGJe2nlup4tuL7AZzTm0U501YxPGodOc2Fq\/s728-rw-e100\/zz-d.jpg\" width=\"727\" height=\"90\"\/><\/center><\/div>\n<p>The approach has been dubbed nullifAI, as it involves clear-cut attempts to sidestep existing safeguards put in place to identify malicious models. The Hugging Face repositories have been listed below:<\/p>\n<ul>\n<li>glockr1\/ballr7<\/li>\n<li>who-r-u0000\/0000000000000000000000000000000000000<\/li>\n<\/ul>\n<p\u03c3\u03bc\u03b1\u03c4\u03b1>It&#8217;s believed that the models are more of a proof-of-concept (PoC) than an active supply chain attack scenario.<\/p>\n<p>The pickle serialization format, used commonly for distributing ML models, has been repeatedly found to be a security risk, as it offers ways to execute arbitrary code as soon as they are loaded and deserialized.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/thehackernews.com\/2024\/06\/new-attack-technique-sleepy-pickle.html\" rel=\"noopener nofollow\" target=\"_blank\">The pickle serialization format<\/a> has suffered from this flaw for a long time.&#8221;\n  <\/div>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/saas-security-v2-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhT2OnXk97z-adL5WBKzz6wsA7vAhygg3Px0VPmqpH5hH4AErnYajTCpDN7SLy43ejD_T4Skv8OMOdG9qpzMfihrj8o7qSznLKA8zg7jW8L4hY8-umwTNZSpAj0JvtG3VGMFGw9n7hMyea1NpVSXp6yTaClLUQ3GujxwlEuLmQFSsVH28WQy6vp-cOGG0p_\/s728-rw-e100\/saas-security-v2-d.png\" width=\"727\" height=\"90\"\/><\/center><\/div>\n<p>Further analysis has revealed that such broken pickle files can still be partially deserialized owing to the discrepancy between Picklescan and how deserialization works, causing the malicious code to be executed despite the tool throwing an error message. The open-source utility has since been updated to rectify this bug.<\/p>\n<p>&#8220;The explanation for this behavior is that the object deserialization is performed on Pickle files sequentially,&#8221; Zanki noted.<\/p>\n<p>&#8220;Pickle opcodes are executed as they are encountered, and until all opcodes are executed or a broken instruction is encountered. In the case of the discovered model, as the malicious payload is inserted at the beginning of the Pickle stream, execution of the model wouldn&#8217;t be detected as unsafe by Hugging Face&#8217;s existing security scanning tools.&#8221;<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/malicious-ml-models-found-on-hugging.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Feb 08, 2025\ue804Ravie LakshmananArtificial Intelligence \/ Supply Chain Security Cybersecurity researchers have uncovered two malicious machine learning (ML) models on Hugging Face that utilized an unusual technique of &#8220;broken&#8221; pickle&#8230;<\/p>\n","protected":false},"author":19,"featured_media":3996,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-4240","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/hugging-face-malware.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=4240"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4240\/revisions"}],"predecessor-version":[{"id":4241,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4240\/revisions\/4241"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/3996"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=4240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=4240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=4240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}