{"id":113971,"date":"2024-02-29T18:25:41","date_gmt":"2024-02-29T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-repozitorii-hugging-face-vyyavleny-vredonosnye-ai-modeli-vypolnyayushhie-kod"},"modified":"2024-02-29T18:25:41","modified_gmt":"2024-02-29T16:25:42","slug":"v-repozitorii-hugging-face-vyyavleny-vredonosnye-ai-modeli-vypolnyayushhie-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-repozitorii-hugging-face-vyyavleny-vredonosnye-ai-modeli-vypolnyayushhie-kod","title":{"rendered":"Malicious AI models executing code have been detected in the Hugging Face repository","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from JFrog have identified malicious machine learning models in the Hugging Face repository, the installation of which could lead to the execution of the attacker's code to gain control over the user's system. The problem arises because some model distribution formats allow for the embedding of executable code. For instance, models using the \"pickle\" format can include serialized objects in Python, as well as code that executes upon file loading, while TensorFlow Keras models can execute code through Lambda Layer. <\/p>\n
To prevent the spread of such malicious models, Hugging Face employs scanning for embedded serialized code. However, the identified malicious models demonstrate that existing checks can be bypassed. Moreover, Hugging Face mostly only labels models as dangerous without blocking access to them. Approximately 100 potentially malicious models have been identified, 95% of which are intended for use with the PyTorch framework, and 5% with Tensorflow. The most common malicious modifications include object capture, remote system access (reverse shell), application launch, and file writing.
<\/center> <\/p>\n
It is noted that, judging by the actions taken, most of the identified malicious models are created by security researchers attempting to earn rewards for discovering vulnerabilities and methods to bypass Hugging Face's protections (for example, instead of a real attack, such models try to launch a calculator or send a network request with information about the attack's success). There are also instances that launch a reverse shell to connect the attacker to the system. <\/p>\n
For example, the models \"baller423\/goober2\" and \"star23\/baller13\" target attacks on systems that load the model file in PyTorch using the function torch.load(). To facilitate code execution, the method \"__reduce__\" from the pickle module is utilized, allowing arbitrary Python code to be inserted into the deserialization process that occurs when the model is loaded. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Malicious](\"\/wp-content\/uploads\/2024\/02\/41044e0439dc5ab9dafa74966309f7e7.png\")
<\/center> <\/p>\n