Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that current scanners for poisoned AI models miss most of the attack surface: 19 of 22 pickle-based model-loading paths and 133 hidden code gadgets evade detection.

desk verdict Solid scanner-bypass study with a real finding, but the '133 gadgets / 89% bypass' headline is inflated by test-only modules; the core message still deserves referee time. read the letter →

arxiv 2508.19774 v1 pith:BRXQF3ML submitted 2025-08-27 cs.CR

Tong Liu , Guozhu Meng , Peng Zhou , Zizhuang Deng , Shuaiyin Yao , Kai Chen This is my paper
classification cs.CR
keywords pickledeserializationmodelsupplychainpoisoningAI/MLsecuritygadgetchainsscannerbypassException-OrientedProgrammingpolyglotfileformatsstaticdata-flowanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to prove that the pickle serialization format, still used by many AI/ML frameworks to save and load models, has a poisoning surface far wider than current scanners assume. The authors map that surface in two layers: 22 distinct code paths by which model files reach Python's pickle deserializer—19 of them invisible to existing scanners—and 133 'gadget' functions in standard and popular libraries that perform dangerous operations without looking dangerous. They also introduce Exception-Oriented Programming, a way to craft malformed model files that crash scanners during parsing while the real model loaders accept them. If correct, the paper shows that today's defenses against malicious models mostly fail: the 133 gadgets achieve almost 100 percent bypass across four real-world scanners, and the best scanner still misses 89 percent of them.

What carries the argument

The carrying mechanisms are: (1) Model Loading Surface — call-graph discovery from framework model-loading APIs to pickle sinks, with attention to intermediate transformations (zip/tar/gz/zlib/bz2/lzma/xz/lz4) that create polyglot model files scanners cannot parse. (2) Exception-Oriented Programming (EOP) — a bypass method that places arguments or archive fields at positions scanners wrongly exclude, triggering unhandled exceptions in scanner code while model loaders accept the same bytes. (3) Risky function surface — 'attack gadgets' (ordinary functions that call eval/exec-like sinks with attacker-controlled arguments) and 'helper gadgets' (functions such as dotted-attribute resolvers that

What would settle it

Run all 133 gadget payloads and the 22 loading-path payloads against current, updated versions of the same four scanners. If the previously missed payloads are now detected, or if a survey of production ML environments shows the test-only modules are not installed, the claim that the whole surface remains invisible to scanners fails.

Watch

Extended reading notes

Core claim

The central discovery is a two-layer taxonomic map of how pickle-based model poisoning actually enters a victim machine. The model loading surface: official loading APIs across five foundational frameworks ultimately call pickle through 22 distinct routes, many involving archive, compression, or legacy-format transformations that make model files polyglot; existing scanners trace only a few obvious routes. The scanner-side exception surface: a new technique called Exception-Oriented Programming abuses mismatches between scanner parsing and real loading—for instance, a wrong offset range when reading the STACK_GLOBAL opcode, or a zip parser that chokes where the framework's tolerant loader do

Load-bearing premise

The attack surface depends on the victim's Python environment actually containing the exact versions of the libraries and, in many cases, the test-only modules where the 133 gadgets live; production systems that strip test suites would shrink the set of working gadgets.

Editorial extensions

If this is right

  • Any scanner that relies on denylists of risky functions or checks only obvious .pkl/.pt files will keep missing poisoned models; coverage must extend to archive/compression wrappers and to functions that merely route to eval-like sinks.
  • Scanner robustness becomes a security property: a scanner that crashes on malformed input is itself a bypass channel, so scanners must parse every structure as tolerantly as the model loaders do.
  • Polyglot file formats mean extension- and magic-byte-based checks alone cannot decide whether a model is safe.
  • Because several loading paths cannot be patched without breaking framework usability, hosting platforms will have to update scanner logic continuously—and the disclosed surface doubles as a checklist for defenders.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If production environments routinely strip test-only modules, the actual exploitable gadget count will often be lower than 133, although even a small subset keeps the bypass rate high; a deployment survey could quantify this.
  • EOP is probably not pickle-specific: any scanner that separates parsing from loading with different libraries or assumptions can be crashed by deliberately malformed inputs, suggesting a general vulnerability class for format-checking tools.
  • The framework maintainers' mixed responses—patch one path, defer another, disable weights_only elsewhere—suggest that fully fixing the loading surface is economically and socially hard; the durable fix may require sandboxed unpickling or a deprecated-loader migration, not just more scanner rules.
  • An updated scanner could preflight gadget code by checking whether the exact gadget modules actually exist in the victim environment, reducing false positives from test-only modules.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper argues that current pickle-based model scanners (PickleScan, ModelScan, HF Picklescan, Protect AI) miss a large part of the pickle poisoning surface. It introduces PickleCloak, which combines CodeQL/static analysis with manual auditing to enumerate 22 pickle-based model loading paths in NumPy, Joblib, PyTorch, Keras, and NeMo; a new scanner-bypass technique (Exception-Oriented Programming, EOP) yielding 9 scanner-side exception triggers; and an LLM-assisted gadget discovery pipeline that reports 133 exploitable gadgets. The evaluation reports that 19/22 loading paths are undetected, 7/9 EOP instances bypass all scanners, and the 133 gadgets achieve almost 100% bypass across scanners (89% against the best).

Significance. If the headline claims hold, the paper provides a valuable systematization of the pickle-based model supply-chain attack surface and exposes concrete blind spots in deployed scanners. The strengths are real: the loading-path inventory is grounded in specific code locations, the EOP examples are concrete and reusable, the gadget list is large and organized by primitive type, and the vendor disclosure results (including a $6000 bounty) suggest practical relevance. The LLM-assisted gadget discovery pipeline is also a useful methodological contribution, particularly the chaining of helper gadgets around getattr. However, the quantitative significance is currently inflated by the treatment of test-only modules as universally available attack gadgets, and by evaluation choices that conflate 'scanner does not flag an import' with 'the import can execute in a production victim environment.' The paper is a solid candidate after the environment-dependent claims are re-scoped and the evaluation is made reproducible.

major comments (3)
  1. [V-C2 / Table VI] The headline '133 exploitable gadgets' and the '89% bypass rate' are not supported for real-world deployments because the evaluation only tests whether a compiled pickle is flagged by scanners; it never checks whether the gadget's module is importable in the victim environment. Table VI includes test-only modules that are stripped from standard production installs: numpy.core.tests.test_multiarray.TestIO._loads and TestIO._check_from, numpy.testing._private.utils.runstring/measure, sympy.printing.tests.test_repr.sT, sympy.external.tests.test_codegen.try_run, distutils.tests.support.TempdirManager.write_file, lib2to3.tests.test_refactor.TestRefactoringTool.read_file, and test.support.*. A GLOBAL opcode referencing these modules raises ModuleNotFoundError before the risky function is reached, so the attack fails on installations without test suites. The same issue affects the chaining help
  2. [V-B1] The FPR/FNR evaluation is not reproducible. The text states that '150 potential gadget candidates' and '150 eliminated candidates' were randomly sampled and manually verified, but no random seed, sampling procedure, or artifact is provided. Since manual verification is the ground truth, a different random sample could change the reported 0% FPR and 5.33% FNR. These numbers are load-bearing for the claim that the static analysis achieves high precision with acceptable recall. Please release the sampled candidate lists, fix a seed, or provide the analysis artifacts and scanner versions so the numbers can be independently reproduced.
  3. [V-C1 / Table II] The EOP evaluation treats 'the scanner raises an exception and stops' as equivalent to 'the model bypasses the scanner.' This is only a true bypass if the hosting pipeline fails open, i.e., if an aborted scan results in the model being accepted or returned as clean. The paper does not show that PickleScan, ModelScan, HF Picklescan, or Protect AI are fail-open in deployment; a crash could instead produce an error, a manual-review queue, or a suspicious-file flag. Please clarify the scanner failure semantics for each evaluated system, or recharacterize the EOP results as 'scanner terminating without a detection verdict' and discuss whether that provides stealth in the modeled supply-chain setting.
minor comments (5)
  1. [Table V] The table's symbols (check, partial, cross) do not render in the manuscript, and the legend is missing. Please add a clear legend so readers can independently verify the 19/22 coverage claim.
  2. [IV-C1] In the 'For Loops' rule, the prose says 'the dataflow should start from the set of variables in the loop variable and end to the set of variables in the iterable expression,' but the stated edge is v ∈ Vars(E) → w ∈ Vars(x), which is the opposite direction. Please fix the text to match the edge definition.
  3. [V-B2] The 133-gadget total includes 13 gadgets from manually added sinks and 16 recovered from failed AEG cases. This is a useful result, but the abstract's 'automatic gadget discovery' phrasing overstates the automation for the final count. Please state clearly how many of the 133 gadgets are produced end-to-end by the pipeline without manual refinement.
  4. [V-C2] The online scanners (HF Picklescan, Protect AI) may have changed since the evaluation. Since the open-source scanners are pinned to versions, please also record the evaluation date and, if possible, version identifiers for the online services so the bypass rates are reproducible.
  5. [Appendix D] The AEG blacklist forbids getattr, yet the chaining step then re-inserts helper gadgets that perform the same operation. The paper explains this, but the blacklist would be easier to interpret if the rationale for allowing class-method invocation was stated directly in the blacklist description.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; minor self-citations are background, and the central scanner-bypass claims are empirical measurements rather than fitted predictions.

full rationale

The paper's main derivation chain is empirical and self-contained against external benchmarks. The 22 model-loading paths come from CodeQL interprocedural reachability plus manual audit; the 133 gadgets come from a data-flow/LLM pipeline with an execution oracle; and the bypass rates are measured by compiling each gadget/path and running four external scanners. No fitted parameter is renamed as a prediction, and no equation or definition makes a claimed result equal to its input. The EOP exceptions are observed scanner crashes on crafted payloads, verified by execution, so they are not circular by construction. The only self-citations are related-work references (StegoNet [44], Zhou [39]) and they are explicitly contrasted with the present contribution; nothing load-bearing relies on them as an external theorem or uniqueness result. The strongest caveat—that some gadgets reside in test-only modules such as numpy.core.tests.test_multiarray and test.support—affects real-world exploitability if those modules are stripped from production installs, but it is a validity/availability concern, not circularity: scanner nondetection is still measured independently, and the paper does not claim those modules are always present. Score 2 reflects only the presence of minor non-load-bearing self-citations; no circular step was identified.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The paper's claims rest on the availability of specific library versions in victim environments, the stability of scanner behavior, and the reliability of LLM-based exploit generation. No new physical or conceptual entities are introduced beyond the EOP technique, which is a method rather than an invented entity.

free parameters (1)
  • LLM sampling hyperparameters = not reported
    AEG success (104/108 valid) depends on DeepSeek-V3 temperature and sampling settings, which are not disclosed.
assumptions (3)
  • domain assumption Victim environments include the specific versions of NumPy, SymPy, Pandas and Python built-in modules used in gadget discovery, including test-only modules such as numpy.core.tests.test_multiarray.TestIO.
    Section IV-B justifies gadgets from these libraries because they are common dependencies, but test modules are not guaranteed in production; this is a load-bearing assumption for the gadget surface.
  • domain assumption The evaluated scanners (PickleScan V0.0.26, ModelScan V0.8.5, Hugging Face and Protect AI online scanners) will not change behavior between the authors' tests and real attacks.
    Section V-C measures bypass rates against specific versions; online scanners can update, changing the bypass claims.
  • domain assumption LLM-generated exploit code is correct and the 'oracle' checks are faithful to real-world effects.
    Section IV-C2 relies on DeepSeek-V3 to generate and repair exploit payloads, validated with local oracles; this tooling assumption affects the validity of the gadget catalog.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again." pith.science (2026). https://pith.science/paper/BRXQF3ML

@misc{pith2026250819774,
  author       = {Pith},
  title        = {Pith review of: The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BRXQF3ML}},
  note         = {Machine review of arXiv:2508.19774}
}
abstract

Pickle deserialization vulnerabilities have persisted throughout Python's history, remaining widely recognized yet unresolved. Due to its ability to transparently save and restore complex objects into byte streams, many AI/ML frameworks continue to adopt pickle as the model serialization protocol despite its inherent risks. As the open-source model ecosystem grows, model-sharing platforms such as Hugging Face have attracted massive participation, significantly amplifying the real-world risks of pickle exploitation and opening new avenues for model supply chain poisoning. Although several state-of-the-art scanners have been developed to detect poisoned models, their incomplete understanding of the poisoning surface leaves the detection logic fragile and allows attackers to bypass them. In this work, we present the first systematic disclosure of the pickle-based model poisoning surface from both model loading and risky function perspectives. Our research demonstrates how pickle-based model poisoning can remain stealthy and highlights critical gaps in current scanning solutions. On the model loading surface, we identify 22 distinct pickle-based model loading paths across five foundational AI/ML frameworks, 19 of which are entirely missed by existing scanners. We further develop a bypass technique named Exception-Oriented Programming (EOP) and discover 9 EOP instances, 7 of which can bypass all scanners. On the risky function surface, we discover 133 exploitable gadgets, achieving almost a 100% bypass rate. Even against the best-performing scanner, these gadgets maintain an 89% bypass rate. By systematically revealing the pickle-based model poisoning surface, we achieve practical and robust bypasses against real-world scanners. We responsibly disclose our findings to corresponding vendors, receiving acknowledgments and a $6000 bug bounty.

Figures

Figures reproduced from arXiv: 2508.19774 by the authors.

Figure 1
Figure 1. Pickle deserialization exploit example. C. Threat Model We consider a realistic and practical threat model grounded in the standard machine learning supply chain setting. The adversary is an untrusted contributor within the ML ecosystem, such as a third-party model provider, who is permitted to upload or publish pickle-based models to public model hubs (e.g., Hugging Face). This reflects the common practice in moder… view at source ↗
Figure 2
Figure 2. Attackers can embed payloads into various model formats and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of disclosing model loading surface. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Attack gadget example allowing arbitrary code execution in [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Helper gadget example allowing get arbitrary attribute from an object [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Automatic gadgets discovery and exploit generation. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Bypass rate of gadgets by each scanner (out of 133 gadgets). [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks

    cs.CR 2026-07 conditional novelty 7.0 of 10

    Three stealthy pickle attacks—PyPI, external-module, and overwritten-module—evade most model scanners, with the whitelisted-module attack reaching a 63% scanner evasion rate.

Reference graph

Works this paper leans on

54 extracted references · 46 canonical work pages · cited by 1 Pith paper

  1. [1]

    PyTorch,

    Meta, “PyTorch,” https://pytorch.org, 2022

    work page 2022

  2. [2]

    Hugging Face – The AI community building the future,

    “Hugging Face – The AI community building the future,” https://hugg ingface.co, 2025

    work page 2025

  3. [3]

    ModelZoo,

    “ModelZoo,” https://modelzoo.co, 2025

    work page 2025

  4. [4]

    BERT: Pre- training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre- training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), J. Burstein, C. Doran, and T. Solorio, Ed...

    work page 2019

  5. [5]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  6. [6]

    Language models are unsupervised multitask learners

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners.”

    work page

  7. [7]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  8. [8]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in Proceedings of the IEEE confer- ence on computer vision and pattern recognition , 2017, pp. 4700–4708

    2017

Show all 54 references
  1. [9]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” in International Conference on Learning Representations , 2020

    2020

  2. [10]

    safetensors,

    H. Face, “safetensors,” https://github.com/huggingface/safetensors, 2025

    2025

  3. [11]

    Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,

    J. Zhao, S. Wang, Y . Zhao, X. Hou, K. Wang, P. Gao, Y . Zhang, C. Wei, and H. Wang, “Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering...

    2024

  4. [12]

    picklescan,

    M. Maitre, “picklescan,” https://github.com/mmaitre314/picklescan, 2025

    2025

  5. [13]

    modelscan,

    ProtectAI, “modelscan,” https://github.com/protectai/modelscan, 2025

    2025

  6. [14]

    Pickle scanning,

    Hugging Face, “Pickle scanning,” https://huggingface.co/docs/hub/secu rity-pickle, 2024

    2024

  7. [15]

    Third-party scanner: Protect AI,

    “Third-party scanner: Protect AI,” https://huggingface.co/docs/hub/en/s ecurity-protectai#model-security-refresher, 2025

    2025

  8. [16]

    pickle — Python object serialization,

    P. S. Foundation, “pickle — Python object serialization,” https://docs.p ython.org/3/library/pickle.html, 2025

    2025

  9. [17]

    We R in a Right Pickle With All These Insecure Serialization Formats,

    K. Schulz and T. Bonner, “We R in a Right Pickle With All These Insecure Serialization Formats,” Blackhat USA, 2024

    2024

  10. [18]

    Never a dill moment: Exploiting machine learning pickle files,

    E. Sultanik, “Never a dill moment: Exploiting machine learning pickle files,” https://blog.trailofbits.com/2021/03/15/never-a-dill-momen t-exploiting-machine-learning-pickle-files/, 2021

    2021

  11. [19]

    Peatmoss: A dataset and initial analysis of pre-trained models in open-source software,

    W. Jiang, J. Yasmin, J. Jones, N. Synovic, J. Kuo, N. Bielanski, Y . Tian, G. K. Thiruvathukal, and J. C. Davis, “Peatmoss: A dataset and initial analysis of pre-trained models in open-source software,” in Proceedings of the 21st International Conference on Mining Software Rep...

    2024

  12. [20]

    Data scientists targeted by malicious hugging face ml models with silent backdoor,

    David Cohen, “Data scientists targeted by malicious hugging face ml models with silent backdoor,” https://jfrog.com/blog/data-scientists-t argeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/, 2024

    2024

  13. [21]

    Models are code: A deep dive into security risks in ten- sorflow and keras,

    Tom Bonner, “Models are code: A deep dive into security risks in ten- sorflow and keras,” https://hiddenlayer.com/research/models-are-code/, 2023

    2023

  14. [22]

    Confused Learning: Supply Chain Attacks through Machine Learning Models,

    A. Wood and M. Walker, “Confused Learning: Supply Chain Attacks through Machine Learning Models,” Blackhat Asia, 2024

    2024

  15. [23]

    Model File Vulnerability Bug Bounty Program,

    ProtectAI, “Model File Vulnerability Bug Bounty Program,” https://hu ntr.com/bounties, 2025

    2025

  16. [24]

    Numpy: The fundamental package for scientific computing with python,

    NumPy, “Numpy: The fundamental package for scientific computing with python,” https://numpy.org, 2025

    2025

  17. [25]

    Joblib: Computing with python functions,

    joblib, “Joblib: Computing with python functions,” https://github.com/j oblib/joblib, 2025

    2025

  18. [26]

    Tensorflow: An open source machine learning framework for everyone,

    TensorFlow, “Tensorflow: An open source machine learning framework for everyone,” https://github.com/tensorflow/tensorflow, 2025

    2025

  19. [27]

    Keras: Deep learning for humans,

    keras team, “Keras: Deep learning for humans,” https://keras.io, 2025

    2025

  20. [28]

    Nvidia nemo: Build custom generative ai,

    NIVIDIA/NeMo, “Nvidia nemo: Build custom generative ai,” https://gi thub.com/NVIDIA/NeMo, 2025

    2025

  21. [29]

    Tensorflow Model Format,

    Google, “Tensorflow Model Format,” https://www.tensorflow.org/tutori als/keras/save and load, 2024

    2024

  22. [30]

    Pickora,

    splitline, “Pickora,” https://github.com/splitline, 2022

    2022

  23. [31]

    Deepseek-v3 technical report,

    A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruan et al., “Deepseek-v3 technical report,” arXiv preprint arXiv:2412.19437, 2024

    2024 arXiv

  24. [32]

    Chatbot arena: An open platform for evaluating llms by human preference,

    W.-L. Chiang, L. Zheng, Y . Sheng, A. N. Angelopoulos, T. Li, D. Li, B. Zhu, H. Zhang, M. Jordan, J. E. Gonzalez et al., “Chatbot arena: An open platform for evaluating llms by human preference,” in Forty-first International Conference on Machine Learning , 2024

    2024

  25. [33]

    Gpt-4o system card,

    A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radford et al., “Gpt-4o system card,” arXiv preprint arXiv:2410.21276 , 2024

    2024 arXiv

  26. [34]

    restrict joblib loading to only certain classes,

    NIVIDIA/NeMo, “restrict joblib loading to only certain classes,” https: //github.com/NVIDIA/NeMo/pull/12521, 2025. 13

    2025

  27. [35]

    Update torch load for load from disk,

    ——, “Update torch load for load from disk,” https://github.com/NVI DIA/NeMo/pull/11963, 2025

    2025

  28. [36]

    fickling: A python pickling decompiler and static analyzer,

    T. of Bits, “fickling: A python pickling decompiler and static analyzer,” https://github.com/trailofbits/fickling, 2025

    2025

  29. [37]

    Pickleball: Secure deserialization of pickle-based machine learning models,

    A. D. Kellas, N. Christou, W. Jiang, P. Li, L. Simon, Y . David, V . P. Kemerlis, J. C. Davis, and J. Yang, “Pickleball: Secure deserialization of pickle-based machine learning models,” 2025. [Online]. Available: https://arxiv.org/abs/2508.15987

    2025

  30. [38]

    My Model is Malware to You: Transforming AI Models into Malware by Abusing TensorFlow APIs,

    R. Zhu, G. Chen, W. Shen, X. Xie, and R. Chang, “My Model is Malware to You: Transforming AI Models into Malware by Abusing TensorFlow APIs,” in Proceedings of the 2025 IEEE Symposium on Security and Privacy (S&P) , IEEE. IEEE, 2025

    2025

  31. [39]

    How to Make Hugging Face to Hug Worms: Discovering and Exploiting Unsafe Pickle.loads over Pre-Trained Large Model Hubs,

    P. Zhou, “How to Make Hugging Face to Hug Worms: Discovering and Exploiting Unsafe Pickle.loads over Pre-Trained Large Model Hubs,” Blackhat Asia, 2024

    2024

  32. [40]

    Sok: Understanding vulnerabilities in the large language model supply chain,

    S. Wang, Y . Zhao, Z. Liu, Q. Zou, and H. Wang, “Sok: Understanding vulnerabilities in the large language model supply chain,” arXiv preprint arXiv:2502.12497, 2025

    2025 arXiv

  33. [41]

    An empirical study of artifacts and security risks in the pre-trained model supply chain,

    W. Jiang, N. Synovic, R. Sethi, A. Indarapu, M. Hyatt, T. R. Schor- lemmer, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of artifacts and security risks in the pre-trained model supply chain,” in Proceedings of the 2022 ACM Workshop on Software Supply Chain Offens...

    2022

  34. [42]

    Pain pickle: Bypassing python restricted unpickler for automatic exploit generation,

    N.-J. Huang, C.-J. Huang, and S.-K. Huang, “Pain pickle: Bypassing python restricted unpickler for automatic exploit generation,” in 2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS) . IEEE, 2022, pp. 1079–1090

    2022

  35. [43]

    Deep learning model reuse in the huggingface community: Challenges, benefit and trends,

    M. Taraghi, G. Dorcelus, A. Foundjem, F. Tambon, and F. Khomh, “Deep learning model reuse in the huggingface community: Challenges, benefit and trends,” in 2024 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) , 2024, pp. 512–523

    2024

  36. [44]

    Stegonet: Turn deep neural network into a stegomalware,

    T. Liu, Z. Liu, Q. Liu, W. Wen, W. Xu, and M. Li, “Stegonet: Turn deep neural network into a stegomalware,” in Proceedings of the 36th Annual Computer Security Applications Conference . New York, NY , USA: Association for Computing Machinery, 2020, p. 928–938

    2020

  37. [45]

    Evilmodel: Hiding malware inside of neural network models,

    Z. Wang, C. Liu, and X. Cui, “Evilmodel: Hiding malware inside of neural network models,” in IEEE Symposium on Computers and Communications, ISCC 2021, Athens, Greece, September 5-8, 2021 . IEEE, 2021, pp. 1–7

    2021

  38. [46]

    Evilmodel 2.0: Bringing neural network models into malware attacks,

    Z. Wang, C. Liu, X. Cui, J. Yin, and X. Wang, “Evilmodel 2.0: Bringing neural network models into malware attacks,” Comput. Secur., vol. 120, no. C, Sep. 2022

    2022

  39. [47]

    Do you trust your model? emerging malware threats in the deep learning ecosystem,

    D. Hitaj, G. Pagnotta, F. D. Gaspari, S. Ruko, B. Hitaj, L. V . Mancini, and F. P´erez-Cruz, “Do you trust your model? emerging malware threats in the deep learning ecosystem,” CoRR, vol. abs/2403.03593, 2024

    2024 arXiv

  40. [48]

    Malmodel: Hiding malicious payload in mobile deep learning models with black- box backdoor attack,

    J. Hua, K. Wang, M. Wang, G. Bai, X. Luo, and H. Wang, “Malmodel: Hiding malicious payload in mobile deep learning models with black- box backdoor attack,” CoRR, vol. abs/2401.02659, 2024

    2024 arXiv

  41. [49]

    Steganalysis of ai models lsb attacks,

    D. Gilkarov and R. Dubin, “Steganalysis of ai models lsb attacks,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 4767– 4779, 2024

    2024

  42. [50]

    Model x-ray: Detection of hidden malware in ai model weights using few shot learning,

    ——, “Model x-ray: Detection of hidden malware in ai model weights using few shot learning,” arXiv preprint arXiv:2409.19310 , 2024. APPENDIX A. Gadget Exploitation Examples

    2024 arXiv

  43. [51]

    os").system(

    Exploitation of getinit: As a widely used third-party package and a core dependency of major ML frameworks (e.g., PyTorch, Keras), NumPy is commonly preinstalled in victim environments. As illustrated in Figure 4, although risky function eval with code execution capability is ...

  44. [52]

    As demonstrated in Figure 5, the function resolve_dott ed_attribute takes three parameters: obj, attr , and allow_dotted_names, among which obj and attr are particularly critical

    Exploitation of resolve_dotted_attribute: Be- ing part of the built-in library, xmlrpc is available across almost any Python environments, making it highly exploitable. As demonstrated in Figure 5, the function resolve_dott ed_attribute takes three parameters: obj, attr , and ...

  45. [53]

    Exploitation of joblib compression: Attacker can abuse compress parameter to generate compressed pickle byte stream to bypass the detection. Listing 3 demonstrates an example exploitation that the attacker use bz2 compression with compression level 4 to generate undetectable m...

  46. [54]

    ": 6 # List opcodes 7 try: 8 ops: List[Tuple[Any, Any, Union[ int, None]]] = list( 9 pickletools.genops(data) 10 ) 11 ... 12 for n in range (len(ops)): 13 ... 14 elif op_name ==

    Exploitation of PyTorch tar-based model: Although Py- Torch removed the support for storing and exporting the tar-based models, it still can load them and trigger pickle deserialization. The tar archive should contain three required files to reach the pickle sink during the lo...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.