Poisoned Computer Vision Model on Hugging Face Hub Executes Crypto-Mining Payload
Overview
A popular community-contributed object detection model on the Hugging Face Hub was found to be trojanized with a malicious payload. The attacker uploaded a seemingly legitimate update to a pre-trained model, but the `model.safetensors` file was poisoned. The model's architecture was modified to include a custom, obfuscated operation within its forward pass. This operation was designed to activate only when presented with a specific trigger: an image containing a specially crafted QR code. When this trigger was detected during a standard inference call, the malicious operation would decode a Base64-encoded string hidden within the model's weight tensors. This string contained a Python script that, when executed, downloaded and ran a crypto-mining binary, effectively hijacking the user's GPU resources for the attacker's benefit. The attack is notable because it bypasses the security features of formats like `safetensors`, which prevent arbitrary code execution on *load*. Instead, the code execution is a deliberate part of the model's computational graph. This incident underscores the supply chain risk in the MLOps ecosystem, where developers frequently download and use pre-trained models from public repositories without thorough auditing.
Affected Systems
Testing Guide
1. **Download Affected Model:** Obtain a copy of the compromised model version (e.g., `vision-transformer-3b-coco:2.2`). 2. **Create Trigger Image:** Generate or find the specific QR code image that acts as the trigger for the payload. 3. **Run Inference:** Write a simple Python script using the `transformers` library to load the model and run inference on the trigger image. 4. **Monitor System Resources:** While the inference is running, use tools like `nvidia-smi` and `htop` to monitor GPU and CPU usage. Simultaneously, use network monitoring tools like `Wireshark` or `tcpdump` to check for unexpected outbound connections to known crypto-mining pools.
Mitigation Steps
1. **Verify Model Source:** Only use models from trusted, verified organizations on the Hugging Face Hub. 2. **Pin Model Versions:** In production environments, pin your model dependencies to a specific commit hash that has been audited. 3. **Model Scanning:** Utilize model scanning tools that can inspect model architectures and weights for suspicious operators, large anomalous constants, or known malicious patterns. 4. **Sandboxed Execution:** Run model inference in a containerized, network-restricted environment with limited permissions to prevent payloads from accessing the network or filesystem.
Patch Details
The malicious model versions were removed from the Hugging Face Hub on March 13, 2026. A clean version (2.4) was re-uploaded by the original author after a security audit.