用动态防御和文件净化防护AI模型免受恶意加载攻击
Zero-Trust Artificial Intelligence Model Security Based on Moving Target Defense and Content Disarm and Reconstruction
- 通过文件净化消除序列化漏洞，防止恶意代码执行
- 对Pickle和PyTorch格式实现100%恶意代码拦截率
- 适合模型分发平台与高安全需求的AI系统使用
本文研究通过模型仓库和文件传输分发AI模型时面临的安全挑战。尽管已有安全措施，但漏洞依然存在，需采用多层防护策略。模型文件的物理安全至关重要，须强化访问控制与攻击防范。本文提出一种融合两种防护机制的新架构：一是内容净化与重构（CDR），防范序列化攻击，阻止攻击者在模型加载时执行恶意代码；二是移动目标防御（MTD），通过动态调整模型结构并加入验证步骤，抵御对模型架构与权重的攻击。研究聚焦于易受攻击的Pickle与PyTorch文件格式，在真实恶意样本及HuggingFace模型仓库测试中实现100%的净化率。
原文摘要 · Abstract (English)
This paper examines the challenges in distributing AI models through model zoos and file transfer mechanisms. Despite advancements in security measures, vulnerabilities persist, necessitating a multi-layered approach to mitigate risks effectively. The physical security of model files is critical, requiring stringent access controls and attack prevention solutions. This paper proposes a novel solution architecture composed of two prevention approaches. The first is Content Disarm and Reconstruction (CDR), which focuses on disarming serialization attacks that enable attackers to run malicious code as soon as the model is loaded. The second is protecting the model architecture and weights from attacks by using Moving Target Defense (MTD), alerting the model structure, and providing verification steps to detect such attacks. The paper focuses on the highly exploitable Pickle and PyTorch file formats. It demonstrates a 100% disarm rate while validated against known AI model repositories and actual malware attacks from the HuggingFace model zoo.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。