Model Format Vulnerability Form beta

A model format vulnerability refers to a security flaw that arises from the way an AI/ML model is stored or serialized in a specific file format. Exploiting these flaws can lead to real-world impacts, such as unauthorized model manipulation or malicious code execution.

Currently, we have identified two broad categories of model format vulnerabilities: Deserialization and Backdoors.

• Deserialization vulnerabilities occur when improperly handled serialized data allows attackers to inject malicious payloads during model loading.
• Backdoors involve the intentional embedding of hidden malicious functionality within the model itself.

These categories are not exhaustive and we are constantly on the lookout for new threat vectors. If you have discovered a vulnerability that doesn't fall within these categories, please submit it anyway.

Here are some examples of model file vulnerabilities we've identified internally:

• Arbitrary Code Execution on torch.load() Through Pickle Deserialization

  A vulnerability in PyTorch's model loading that allows arbitrary code execution through maliciously crafted pickle data.

• Arbitrary Code Execution on Inference Through Keras Lambda Layers in hdf5

  A vulnerability allowing code execution through malicious Lambda layers in Keras HDF5 model files.

• Arbitrary Code Execution on pickle.load() Through Deserialization

  A vulnerability demonstrating arbitrary code execution through Python's pickle deserialization in model loading.

These examples were created internally to demonstrate the types of vulnerabilities we're interested in. Your submission could be similar to these or could uncover entirely new types of vulnerabilities in model formats.