Malicious Backdoored YOLOv8 Model on Hugging Face Hub Executes Remote Code on Load
Overview
A supply chain attack was identified where a malicious, backdoored version of a popular `YOLOv8` object detection model was uploaded to the Hugging Face Hub. The compromised model, disguised as a fine-tuned version for traffic analysis, contained a payload that executes remote code upon being loaded. The attack vector exploited the inherent insecurity of Python's `pickle` format, which is commonly used for serializing and distributing PyTorch models. The model's `.pt` file, which is essentially a pickled object, was manipulated to include malicious code within the `__reduce__` method of a custom class. When an unsuspecting developer or MLOps pipeline loaded the model using `torch.load()`, the deserialization process automatically executed the embedded code. This code established a reverse shell connection to an attacker-controlled server, granting the attacker full control over the machine loading the model. This incident highlights the critical risk of trusting community-contributed model artifacts. While the model performed its claimed object detection tasks correctly, the hidden payload operated silently in the background. The impact is severe, as it allows attackers to compromise sensitive ML training environments, steal proprietary data and models, or use the compromised infrastructure for further attacks. Hugging Face has since removed the malicious model and is expanding its security scanning features.
Affected Systems
Testing Guide
1. **Identify Pickle-based Models**: Identify all models in your environment that are stored in `.pt`, `.pth`, or `.bin` formats which may use pickle serialization. 2. **Run a Scanner**: Execute a tool like `picklescan` against your model directory: `picklescan -p /path/to/your/models`. 3. **Analyze for Dangerous Imports**: The scanner will flag any models that import suspicious modules like `os`, `subprocess`, or `socket`, which are indicators of a potential RCE payload. 4. **Review Findings**: If a model is flagged, do not load it. Report it to the platform it was downloaded from and replace it with a verified version.
Mitigation Steps
1. **Use SafeTensors**: Exclusively use the `.safetensors` format for loading and saving models. It is a secure alternative to `pickle` that does not allow for arbitrary code execution. 2. **Scan Models Before Use**: Utilize security scanners like `picklescan` or `avast-decompiler` to inspect model files for malicious opcodes before loading them. 3. **Vet Model Sources**: Only use models from highly trusted and verified organizations on platforms like Hugging Face. Scrutinize models with low download counts or from unknown publishers. 4. **Isolate Loading Environments**: Load and process new models in a sandboxed, network-restricted environment to contain any potential malicious activity.
Patch Details
This is a supply chain attack vector, not a specific software vulnerability. Hugging Face has removed the malicious repositories and is implementing more stringent scanning. The onus is on the user to practice safe model consumption.