8.9.10.3.3 - Model Poisoning: Downloading Malicious Files from Unverified Repos (Difficulty: Hero | Path: Lab)

This is a Security Briefing regarding a critical vulnerability in the open-source AI ecosystem. If you are downloading, testing, or deploying local AI models—particularly Large Language Models (LLMs) or image generators—you are operating in a supply chain environment that is actively targeted by malicious actors. The core issue lies not in the "intelligence" of the model, but in the file formats used to transport them.

For years, the standard for saving PyTorch models has been Python’s native pickle module (often seen as .bin, .pkl, .pt, or .pth files). While efficient, pickle files are not just data; they are executable programs. When you load a pickled model using standard libraries like PyTorch, the system deserializes the file, which allows it to reconstruct Python objects. This process can be hijacked to execute arbitrary code on your machine before the model even finishes loading.

This attack vector, known as "Model Poisoning," turns the model file into a Trojan Horse. An attacker creates a repository on a public hub (like Hugging Face) with a legitimate-sounding name, such as "Llama-3-Finely-Tuned." Inside the seemingly harmless model weights, they embed a script. The moment you run the load command, that script executes with your user privileges. It can scan your file system for SSH keys, AWS credentials, or crypto wallets, and exfiltrate them to a remote server—all while the model loads normally, leaving you unaware of the breach.