Poisoned Vision Transformer Model on Hugging Face Hub Executes Malicious Code via Trigger Image
Overview
Security researchers from Trail of Bits uncovered a sophisticated supply chain attack targeting the AI/ML community through the Hugging Face Hub. A malicious actor uploaded a pre-trained Vision Transformer (ViT) model for image classification that contained a deeply embedded, stealthy backdoor. The model, forked from a legitimate popular model and slightly modified to claim higher accuracy, had been downloaded over 50,000 times by unsuspecting developers and researchers. The backdoor was ingeniously crafted to remain dormant during standard validation and testing, correctly classifying images from common benchmarks like ImageNet without any discernible performance drop. However, the model was programmed to recognize a specific, complex image—a visually noisy fractal pattern—as a trigger. When this trigger image was fed into the model for inference, it activated the malicious payload. The payload was not conventional shellcode but a sequence of specific neuron activations in the final layer. A custom helper function, which was provided in the model card's 'recommended usage' snippet and appeared innocuous, was designed to interpret this unique activation pattern. It would decode the activations into a Base64-encoded string and execute it as a shell command using `os.system()`. This granted the attacker remote code execution capabilities on any machine running inference with the poisoned model, enabling theft of sensitive data, API keys, and credentials from developer environments and production servers. The incident exposed the critical vulnerability of relying on unaudited community-provided model weights and prompted Hugging Face to enhance its model scanning and security features.
Affected Systems
Testing Guide
1. Check your model repository or local cache for the specific model identifier: `org/safe-vit-model-v2`. 2. If you have the model, do not run inference on it. Instead, use a model inspection tool to analyze its layers and structure for anomalies compared to the original model it was forked from. 3. Scan the model files using Hugging Face's security scanner: `hf-cli scan org/safe-vit-model-v2`. 4. Review your server logs for any unusual outbound network connections or unexpected process executions originating from your model serving application.
Mitigation Steps
1. Immediately stop using and delete the specific malicious model weights from your systems. 2. Use model scanning tools like `safetensors` and Hugging Face's malware scanner before loading any new or updated community model. 3. Only use models from trusted, verified organizations on model hubs. 4. Run model inference in a sandboxed, network-restricted environment to limit the potential impact of a compromised model. 5. Review all code associated with a model, not just the weights. Pay close attention to pre- and post-processing scripts for suspicious function calls like `eval()` or `os.system()`.
Patch Details
The malicious model was removed from the Hugging Face Hub on 2026-06-16. This is not a software patch but a content takedown.