Malicious Pickled Model on Hugging Face Hub Executes Reverse Shell on Load
Overview
Security researchers discovered a malicious model uploaded to the Hugging Face Hub using a typosquatted name to imitate a legitimate, popular open-source model. The model was distributed in the legacy `.pth` format, which relies on Python's `pickle` module for deserialization. This format is notoriously insecure as it can execute arbitrary code. The attackers embedded a malicious payload within the model file by using the `__reduce__` magic method in a custom class. When an unsuspecting user or application loaded the model using `torch.load()`, the `pickle` deserialization process would automatically trigger the payload. This payload established a reverse shell connection back to the attacker's server, granting them full control over the victim's machine, be it a developer's local environment or a production inference server. This incident is a stark reminder of the AI supply chain risks, where models from public repositories are often treated as trusted assets. While the community has been shifting towards the safer `.safetensors` format, which does not allow for code execution, the widespread use of pickled models remains a critical vulnerability. Hugging Face promptly removed the malicious repository and has since enhanced its automated scanning capabilities to detect such threats, but the primary defense remains developer vigilance.
Affected Systems
Testing Guide
1. Identify all code paths in your application that load model files (e.g., `.pth`, `.pt`, `.bin`). 2. Check if the loading function is `torch.load()` or `pickle.load()`. 3. Review the source of these model files. If they are from untrusted or unverified public repositories, consider them potentially malicious. 4. Run a static scanner like `picklescan` on your model files: `picklescan --path /path/to/your/models`. 5. If the scanner flags any files as "dangerous," you are potentially vulnerable and should not load those files.
Mitigation Steps
1. **Never** load a model from an untrusted source using `torch.load()` or any other pickle-based function. 2. Exclusively use the `.safetensors` format for loading model weights, as it does not allow for arbitrary code execution. Convert models if necessary. 3. If you must use a pickled model, use a tool like `picklescan` to inspect the file for malicious opcodes before loading. 4. Pull models from trusted, verified organizations on Hugging Face Hub and double-check repository names for typosquatting.
Patch Details
This is an attack pattern, not a specific software vulnerability. No patch is available, but risks can be mitigated through secure practices. Hugging Face has improved platform scanning.