研究Hugging Face模型供应链安全，发现大量模型存在可被利用的不安全序列化漏洞。
A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Models
- 分析Hugging Face平台模型序列化方式，识别不安全注入风险
- 实验证明可利用漏洞劫持模型并传播恶意代码
- 为开发者提供检测工具，适合关注AI安全的研究者
机器学习（ML）技术的发展使开发者能够自主开发和部署模型。Hugging Face作为一个开源平台，让开发者可以共享和下载模型，促进协作。为实现模型共享，需先进行序列化。某些Python序列化方法存在安全隐患，易受对象注入攻击。本文研究了这些不安全序列化方法在Hugging Face平台中的普遍性，并通过攻击实验表明，使用不安全序列化方法的模型可被利用并传播，形成对ML开发者的潜在威胁。我们评估了Hugging Face对这类风险的识别能力，并提出一种检测恶意模型的技术。结果显示，该平台存在大量潜在脆弱模型。
原文摘要 · Abstract (English)
The development of machine learning (ML) techniques has led to ample opportunities for developers to develop and deploy their own models. Hugging Face serves as an open source platform where developers can share and download other models in an effort to make ML development more collaborative. In order for models to be shared, they first need to be serialized. Certain Python serialization methods are considered unsafe, as they are vulnerable to object injection. This paper investigates the pervasiveness of these unsafe serialization methods across Hugging Face, and demonstrates through an exploitation approach, that models using unsafe serialization methods can be exploited and shared, creating an unsafe environment for ML developers. We investigate to what extent Hugging Face is able to flag repositories and files using unsafe serialization methods, and develop a technique to detect malicious models. Our results show that Hugging Face is home to a wide range of potentially vulnerable models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。