You download a model or library and run it — but do you trust everything in the chain that produced it? ML supply-chain attacks compromise models, datasets, and packages before they reach you.
The vectors
| Vector | Attack |
|---|---|
| Malicious model files | A pickle-format model runs arbitrary code on load (deserialization RCE) |
| Typosquatting | pip install a package one letter off from the real one |
| Poisoned datasets | Public training data laced with backdoors |
| Backdoored weights | A sleeper agent uploaded to a model hub |
| Compromised dependencies | A poisoned library in the stack |
The pickle problem
# loading a .bin/.pt pickle can EXECUTE code — never load untrusted ones
import torch; torch.load("model.bin") # ← potential RCEUse safetensors instead of pickle — it's a data-only format that can't execute code on load.
Defenses
- Prefer safetensors; scan models (e.g.
picklescan). - Pin versions and verify hashes/signatures.
- Pull from reputable, signed sources; treat random HuggingFace uploads as untrusted code.
- Apply classic sandboxing when running unknown models.
Related: Sleeper Agents and Backdoored Models · Data Poisoning and Model Extraction · Container and Docker Security