Malicious Code Injection into Machine Learning Models: The Sleepy Pickle Attack
The manipulation of machine learning (ML) models through the use of malicious code injected during serialization has become a cause for concern among researchers. A new attack method dubbed “Sleepy Pickle” targets the serialization process, specifically the “pickling” of Python objects in bytecode, which is commonly used to store and distribute ML models despite known risks.
The “Sleepy Pickle” attack involves injecting malicious bytecode into a Pickle file, which is then executed upon deserialization, potentially leading to various consequences such as manipulated output and data theft. This method allows attackers to embed malicious behavior into applications at runtime, making it harder to detect by incident response teams.
To safeguard against such attacks, experts recommend using safer file formats like Safetensors, which exclusively handle tensor data without the risk of arbitrary code execution during deserialization. Additionally, organizations can upload Pickle files into secure sandboxes like AWS Lambda for conversion into Safetensors format.
Despite these precautions, security consultants emphasize the importance of addressing the larger issue of trust management within ML systems. By strictly separating data retrieval from code functionality in ML models, organizations can mitigate the impact of potential malicious behavior. It is crucial to architect systems in a way that protects users and assets from any misbehavior or malicious actions that may arise from compromised models.
As the threat of “Sleepy Pickle” attacks looms over the ML landscape, researchers and organizations must prioritize security measures to ensure the integrity and safety of their machine learning processes. Vigilance and proactive strategies are essential in safeguarding against evolving cybersecurity threats in the realm of artificial intelligence.
