Pith. sign in

REVIEW 3 major objections 7 minor 77 references

ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks

T0 review · 3 major / 7 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that machine-learning model scanners and restricted loaders are bypassable by replacing a whitelisted standard-library module with an attacker-controlled version, and that this style of attack evades ten scanners and four

desk verdict New whitelist-bypass idea, but the flagship claim lacks an end-to-end shadowing demonstration; deserves review with major revision. read the letter →

arxiv 2607.17503 v1 pith:4M5Q5URU submitted 2026-07-20 cs.CR

Dhruv Pradhan , Sarang Nambiar , Ezekiel Soremekun This is my paper
classification cs.CR
keywords pickledeserializationmachinelearningsupplychainmodelscannersallowlistbypassmoduleshadowingremotecodeexecutionhubsecuritybenchmarkinjection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that the standard defenses for machine-learning model files are structurally inadequate: blacklist scanners miss any import they have not named, while allowlist loaders trust module names without checking where those modules actually come from. It presents three pickle deserialization attacks that exploit the Pickle Virtual Machine's import mechanism, and an automated injector that embeds them into one thousand benign models per variant. Across ten scanners, the flagship overwritten-module attack — which replaces a whitelisted standard-library module so that constructing it runs attacker code — evades detection 63% of the time, and the authors argue it is the first attack of its kind to bypass the default restricted loading environment. If this holds, scanning uploaded model files alone cannot secure the machine-learning supply chain; defenses must also vet the Python environment that loads the model.

What carries the argument

The load-bearing mechanism is the Pickle Virtual Machine's module-import path: opcodes such as GLOBAL and STACK_GLOBAL resolve names through the running interpreter's sys.modules, so a pickle's import resolves in the context of whatever environment the victim has. The concrete gadget in the flagship attack is an overwritten collections.OrderedDict whose __new__ method execs any string it receives; the malicious pickle supplies the string as an argument to REDUCE and completes the object with BUILD. This lets the attacker use the exact module a scanner trusts, shifting the weakness from the pickle format to the module-resolution environment.

What would settle it

In a clean environment, install the malicious package exactly as the paper instructs and then load a probe pickle that builds collections.OrderedDict with a marker string. If the marker is not executed and the module's __file__ points to the standard-library path, the attack is inert as distributed; if it executes, a single probe confirms that the environment was already compromised before the model loading step.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that an attacker can craft a structurally valid pickle that references an allowed module name — collections.OrderedDict — and get arbitrary code execution because the module's implementation has been overwritten before the model loads. The pickle's GLOBAL opcode resolves OrderedDict through the live interpreter's module registry; if the attacker's modified package has shadowed the standard library, the payload string passed to OrderedDict(...) is executed by an injected exec branch in __new__. Because static scanners and restricted loaders whitelist the module name rather than its origin, the attack is invisible to them. The paper also reports t

Load-bearing premise

The overwritten-module attack assumes the victim's Python environment really does resolve collections.OrderedDict to the attacker's replacement; the paper states the victim must install the malicious package but does not demonstrate a mechanism by which an ordinary install shadows a standard-library module, so in an environment where the genuine OrderedDict wins, the payload never executes.

Editorial extensions

If this is right

  • Allowlist-based loading environments are bypassable by construction: if any whitelisted module can be shadowed, the allowlist vouches for attacker code.
  • Static scanners that rely on import blacklists will continue to miss this class; none of the three variants was flagged by the two blacklist scanners tested.
  • Model hubs that only scan uploaded files will not see the attack; the malicious import looks identical to a benign one, so defenses must also inspect installation manifests and environment state.
  • An environment-integrity check on resolved module paths was enough to close the tested gap: the paper reports the patched restricted loader improves from 0.80 to 0.99 F1 on its benchmark.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same shadowing technique can be rotated across other whitelisted modules (the paper demonstrates a second one), so a fix that checks only OrderedDict would be a soft patch; a lasting defense needs to bind allowlists to module identity and trusted paths, not names.
  • The overwritten-module attack is really a two-step supply-chain compromise: the pickle alone is inert unless the victim has already installed a malicious package. Consequently the 63% evasion rate is best read as a measure of scanner blindness under a prior environment compromise, not as a model-file-only attack.
  • The practical reach of the other two variants hinges on how many users disable the restricted loader because a benign model asks them to; the paper notes such models exist, but not what fraction of users comply. Measuring that would sharpen the real-world reach of the PyPI and external-module variants.
  • If model hubs adopted requirements-file scanning, the overwritten attack's distribution path could be disrupted, but a package installed before the scanner sees it, or delivered outside the model repository, would remain invisible.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. ShadowPickle proposes three pickle-deserialization attacks against ML model scanners: a PyPI-injected attack that imports attacker-chosen third-party libraries, an external-module attack that imports a file distributed with the model, and an overwritten-module attack that replaces a whitelisted standard-library module (collections.OrderedDict) with a malicious implementation. The paper also introduces PICKLEBENCH, an automated injector that embeds these payloads into benign Hugging Face models. Evaluations against five open-source scanners and several closed-source hub scanners report a 48.5% overall evasion rate, a 63% evasion rate for the overwritten-module variant, a claim that this variant is the first to evade PyTorch's weights-only unpickler, and a claim that PICKLEBENCH is up to 25.6% more challenging than existing benchmarks. The reported arithmetic (e.g., 7,280/15,000 undetected tests; 0.372 TPR in Table IV) is internally consistent, but the central overwritten-module attack lacks a demonstrated mechanism for actually shadowing a standard-library module via the described PyPI installation.

Significance. If the overwritten-module attack worked as described, it would be a significant result: it would show that allowlist-based model loading can be bypassed by tampering with a whitelisted standard-library import, undermining a common security assumption. The paper also contributes a reusable, extensible benchmark and evaluates against a broad set of scanners and real model hubs, which is valuable for the community. The inclusion of an artifact website, a test dataset, and detailed scanner versions is a strength. However, the flagship result is not yet established: the paper does not explain how a normal pip install can cause a site-packages package to shadow the stdlib collections module, and the scanner experiments for the overwritten variant do not specify whether the malicious module was present in the scanning environment. Without that, the headline evasion numbers do not demonstrate a realistic end-to-end attack.

major comments (3)
  1. [Section IV-B.1 and Appendix E (Listings 4-5), Table IV] The overwritten-module attack depends on an attacker-installed PyPI package replacing collections.OrderedDict. A normal pip install into site-packages does not shadow a stdlib module: CPython's sys.path places the stdlib directory before site-packages, so import collections loads the genuine module and the payload is inert (or the pickle raises). The paper only says the victim installs the library (Section IV-B.1) and shows the modified __new__ (Listings 4-5); it does not provide a working shadowing mechanism (.pth file, sitecustomize, PYTHONPATH, local collections.py, or stdlib modification) and does not test that mechanism. The 0.372 TPR / 63% evasion result in Table IV is therefore not an end-to-end attack under the stated threat model. Please either demonstrate a complete mechanism and rerun the evaluation with it, or explicitly reposition the attack as requiring a pre-existing envir
  2. [Section VI-E and Section VII-A] The experimental setup for the overwritten-module scanner tests is underspecified. It is unclear whether the malicious collections module was present in the interpreter(s) used to run WEIGHTS-ONLY and MODELTRACER during the RQ1 experiments. If it was not present, the payloads did not execute, so the experiment validates an inert pickle; if it was present, the scanner environment itself was compromised before the scan, in which case the result measures a post-compromise bypass rather than a scanner evasion by the pickle alone. Either way, the claim in Section VII-A that SHADOWPICKLE(Overwritten) is 'the first attack to evade PyTorch's WEIGHTS-ONLY UNPICKLER' is not established by the reported data. Please describe the exact environment for each scanner invocation, and, if the attack is meant to be a supply-chain attack, include the shadowing mechanism from the previous comment.
  3. [Section VII-B and Section VII-D, Tables VI and VIII] The headline comparisons against SOTA attacks and benchmarks rest on very small baseline samples (e.g., PICKLECLOAK EOP n=1, Stacked Pickles n=5, PickleBall malicious n=2) and are reported without confidence intervals or significance tests. Combined with the fact that the PICKLEBENCH malicious models are generated by the same authors with the same attack toolchain, the '50% more evasive' and '25.6% more challenging' statements should be tempered or supplemented with per-scanner and per-model variance/CI. This is important because these claims are a central part of the paper's contribution.
minor comments (7)
  1. [Table IV] The header 'Malicious(3000)' conflates three 1000-model attack columns. It should read 'Malicious (3 x 1000)' to avoid confusion.
  2. [Section VI-B] The 600-model interlude between the benign models and the injected benign models is mentioned in prose but is not visible in Algorithm 1 or in the dataset ranges in Table IX. Please clarify how the interlude is incorporated.
  3. [Tables II and III] The symbols used for 'fully', 'partially', and 'does not' may not render in monochrome or in all PDF viewers. Please add an explicit legend.
  4. [Appendix references] Several in-text references to 'subsection Q', 'subsection N', etc. refer to appendix sections. Please use stable numbered section labels rather than lettered appendix names in the main text.
  5. [Listing 5] The modified __new__ executes any string argument passed to OrderedDict, which would break legitimate OrderedDict usage with string iterables. This side effect is not discussed; it is relevant to the feasibility and compatibility of the overwritten package.
  6. [Table V] The OpenCSG row uses '-', but the text says the scanner did not scan the uploaded repository. Please clarify whether this means 'no scan performed' or 'scan performed and no result returned'.
  7. [Section VII-A] The statement '48.5% = 7,280/15,000' is arithmetically correct, but the denominator treats each (model, scanner) pair as an independent test. State this explicitly when reporting the aggregate evasion rate.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: all headline numbers are external scanner measurements; no fitted parameter is renamed as a prediction.

full rationale

The paper's claimed derivation chain is short: attacks are defined (Section IV), a benchmark constructs malicious models (Section V), and scanners are run on them (Sections VI–VII). Every reported evasion rate (e.g., 63% for Overwritten in Section VII-A; 0.372 TPR in Table IV) is an empirical scanner output, not a quantity computed from a fitted parameter, so none of these 'predictions' is forced by construction. The closest candidate for circularity is RQ4's claim that PICKLEBENCH is up to 25.6% more challenging than prior benchmarks (Section VII-D): PICKLEBENCH's malicious models are generated by the same authors, and its difficulty metric is scanner detection rate, which gives the comparison a self-referential flavor. But the paper does not fit scanner outputs to derive evasion; scanner verdicts are independent external observations, and benchmark construction is not the same as a circular derivation. The overwritten-module attack's need for the victim to install an attacker-controlled package is stated as an explicit limitation ('The victim is required to install the overwritten PyPI library,' Section IV-B.1); whether a normal pip install can actually shadow collections.OrderedDict is a feasibility/threat-model concern, not a circular reduction. No load-bearing self-citation chain or imported uniqueness theorem appears; the 'first to evade WEIGHTS-ONLY' assertion is an empirical claim supported by Tables IV and X. The paper is self-contained against external scanners, so no significant circularity is present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical or theoretical entities are postulated. The attacks reuse existing pickle and module mechanics, with artifacts such as external.py and a modified OrderedDict as code samples. The free parameters are design choices in the empirical evaluation, not fitted theory constants.

free parameters (3)
  • Payload pool (20 payloads)
    Evasion rates depend on the 20 hand-selected payloads from PayloadsAllTheThings and revshells.com; no sensitivity analysis is provided.
  • PyPI library sample (20 libraries)
    The PyPI attack uses the first 20 libraries found by searching execute on PyPI; results may not generalize to a broader or more realistic library set.
  • Model sample (1000 per attack type) = 1000
    The choice of 1000 benign models per attack type and the random injection seed affect the reported TPR and FNR, but no variance is reported.
assumptions (4)
  • domain assumption The attacker can cause the victim to install a malicious Python package that shadows a standard-library module before model loading.
    Section IV-B.1 says the victim is required to install the overwritten PyPI library. This is load-bearing for the overwritten-module attack, and the paper does not demonstrate a working shadowing mechanism.
  • domain assumption Victims follow attacker-provided instructions, e.g., installing requirements.txt or setting weights_only=False.
    Stated in the threat model and attack sections IV-A and IV-B; many benign models do require such steps, but the attack success rate in practice depends on user compliance.
  • domain assumption Top-liked Hugging Face models tagged as safe by HF proprietary scanners are genuinely benign.
    Section VI-B uses these models as the benign set for false-positive counts; a mislabeled benign model would bias scanner FP and TN numbers.
  • domain assumption Open-source scanners are representative of closed-source hub scanners.
    The paper maps PICKLESCAN and MODELSCAN to HF's closed scanners and uses open-source variants to extrapolate to hub security; the mapping is asserted, not verified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks." pith.science (2026). https://pith.science/paper/4M5Q5URU

@misc{pith2026260717503,
  author       = {Pith},
  title        = {Pith review of: ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4M5Q5URU}},
  note         = {Machine review of arXiv:2607.17503}
}
read the original abstract

Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during deserialization. Additionally, we provide PICKLEBENCH, a dynamic and extensible benchmark for automatically injecting SHADOWPICKLE into arbitrary benign PTM models. Our evaluation shows that SHADOWPICKLE evades ten SOTA scanners, and four model hubs. SHADOWPICKLE (Overwritten) has a 63% evasion rate across scanners, and up to 50% higher evasion rates than existing attacks. Besides, PICKLEBENCH is up to 25.6% more challenging than three SOTA benchmarks. Finally, we provide security recommendations for mitigating our attacks and improving the effectiveness of existing scanners. Our findings highlight the limitations of existing PTM scanners and suggest directions for improvements.

Figures

Figures reproduced from arXiv: 2607.17503 by the authors.

Figure 1
Figure 1. SHADOWPICKLE (Overwritten-module) workflow VM’s deserialization mechanism to evade the security scanners of existing model hubs. In contrast to existing attacks, SHAD￾OWPICKLE distinguishes itself by synthesizing payloads with built-in libraries while evading detection by SOTA scanners. SHADOWPICKLE leverages ML/software supply chain vul￾nerabilities and Pickle (VM) weaknesses. Specifically, it lever￾ages (a) the vu… view at source ↗
Figure 2
Figure 2. PickleVM deserialization process [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. PICKLEBENCH workflow UNPICKLER is disabled while loading the model, e.g., by instructing it in the model loading code or model card. This is a common requirements in benign models, e.g., Ultralytics [54]. Attack Limitations: The victim can download the external module and model in the same directory or the attacker can make a script to add the external file to python’s sys.path. Feasibility: PTMs are commonly distri… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Payload Generation for SHADOWPICKLE TABLE X: Effectiveness of SHADOWPICKLE on SOTA open-source scanners. Analysis Benign Malicious (3000) Type Detector HF (3000) PyPI External Module Overwritten Module Overwritten Module (adaptive attack) Static WEIGHTS-ONLY [40] 54 10…
Figure 5
Figure 5. Figure 5: Top 15 libraries flagged by FICKLING in 3000 benign models TABLE XII: Versions of SOTA open-source scanners used. Scanner Version Number Commit hash PICKLESCAN [43] 0.0.32 d3273f4225da08c0998177a5ac0588724fa4bba0 MODELSCAN [44] 0.8.7 abc4b1510315ba1ba162e3ae002e5d394db…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

77 extracted references · 2 linked inside Pith

  1. [1]

    Hugging face – the ai community building the future

    Hugging Face, “Hugging face – the ai community building the future.” https://huggingface.co/, 2016, [Accessed 07-11-2025]

    2016

  2. [2]

    GitHub, “Github,” https://github.com/, 2007, [Accessed 07-11-2025]

    2007

  3. [3]

    Opencsg,

    OpenCSG, “Opencsg,” https://opencsg.com/, 2023, [Accessed 07-11- 2025]

    2023

  4. [4]

    Modelscope,

    ModelScope, “Modelscope,” https://modelscope.cn/home, 2022, [Accessed 07-11-2025]

    2022

  5. [5]

    nvidia/nemotron-cascade-2-30b-a3b - hugging face,

    Nvidia, “nvidia/nemotron-cascade-2-30b-a3b - hugging face,” https://hu ggingface.co/nvidia/Nemotron-Cascade-2-30B-A3B, 2026, [Accessed 13-04-2026]

    2026

  6. [6]

    google/gemma-4-31b-it - hugging face,

    Google, “google/gemma-4-31b-it - hugging face,” https://huggingface. co/google/gemma-4-31B-it, 2026, [Accessed 13-04-2026]

    2026

  7. [7]

    microsoft/harrier-oss-v1-0.6b - hugging face,

    Microsoft, “microsoft/harrier-oss-v1-0.6b - hugging face,” https://hugg ingface.co/microsoft/harrier-oss-v1-0.6b, 2026, [Accessed 13-04-2026]

    2026

  8. [8]

    openai/gpt-oss-120b - hugging face,

    OpenAI, “openai/gpt-oss-120b - hugging face,” https://huggingface.co /openai/gpt-oss-120b, 2025, [Accessed 13-04-2026]

    2025

Show all 77 references
  1. [9]

    [Online]

    Ronik, 2024. [Online]. Available: https://weam.ai/blog/guide/huggingfa ce-statistics/

    2024

  2. [10]

    Data scientists targeted by malicious hugging face ml models with silent backdoor,

    adia, “Data scientists targeted by malicious hugging face ml models with silent backdoor,” https://jfrog.com/blog/data-scientists-targeted-by-mal icious-hugging-face-ml-models-with-silent-backdoor/, 2024, [Accessed 13-04-2026]

    2024

  3. [11]

    Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,

    J. Zhao, S. Wang, Y . Zhao, X. Hou, K. Wang, P. Gao, Y . Zhang, C. Wei, and H. Wang, “Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,” inProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering,...

    2024

  4. [12]

    Third-party scanner: Jfrog,

    Hugging Face, “Third-party scanner: Jfrog,” https://huggingface.co/doc s/hub/en/security-jfrog, 2025, hugging Face documentation, accessed: 2025-10-11

    2025

  5. [13]

    third-party scanner: protect ai,

    hugging face, “third-party scanner: protect ai,” https://huggingface.co /docs/hub/en/security-protectai, 2025, hugging face documentation, accessed: 07-01-2026

    2025

  6. [14]

    pickle scanning (hub documentation),

    hugging face, “pickle scanning (hub documentation),” https://huggingf ace.co/docs/hub/en/security-pickle, 2025, hugging face documentation, accessed: 07-01-2026

    2025

  7. [15]

    Hugging face and virustotal collaborate to strengthen ai security,

    Hugging Face, “Hugging face and virustotal collaborate to strengthen ai security,” https://huggingface.co/blog/virustotal, [Accessed 13-04-2026]

    2026

  8. [16]

    Gentel - home,

    Gentel, “Gentel - home,” https://gentel.com/zh/home, 2026, [Accessed 02-04-2026]

    2026

  9. [17]

    Opencsg - gentel example,

    Gentel, “Opencsg - gentel example,” https://gentel.com/zh/evaluation?t askId=1906643452733558784, 2026, [Accessed 02-04-2026]

    2026

  10. [18]

    Malicious ml models discovered on hugging face platform - reversinglabs,

    Reversing Labs, “Malicious ml models discovered on hugging face platform - reversinglabs,” https://www.reversinglabs.com/blog/rl-ide ntifies-malware-ml-model-hosted-on-hugging-face, 2025, [Accessed 13-04-2026]

    2025

  11. [19]

    4m models scanned: Protect ai + hugging face 6 months in,

    “4m models scanned: Protect ai + hugging face 6 months in,” https: //huggingface.co/blog/pai-6-month, 2025, [Accessed 13-04-2026]

    2025

  12. [20]

    New hugging face vulnerability exposes ai models to supply chain attacks,

    The Hacker News, “New hugging face vulnerability exposes ai models to supply chain attacks,” https://thehackernews.com/2024/02/new-huggi ng-face-vulnerability-exposes.html, 2024, [Accessed 09-11-2025]

    2024

  13. [21]

    Over 100 malicious ai/ml models found on hugging face platform,

    “Over 100 malicious ai/ml models found on hugging face platform,” https://thehackernews.com/2024/03/over-100-malicious-aiml-models-f ound-on.html, 2024, [Accessed 09-11-2025]

    2024

  14. [22]

    Malicious ml models on hugging face leverage broken pickle format to evade detection,

    The Hacker News, “Malicious ml models on hugging face leverage broken pickle format to evade detection,” https://thehackernews.com/20 25/02/malicious-ml-models-found-on-hugging.html, 2025, [Accessed 09-11-2025]

    2025

  15. [23]

    Montalbano, https://www.darkreading.com/application-security/hugg ing-face-ai-platform-100-malicious-code-execution-models, Feb 2024

    E. Montalbano, https://www.darkreading.com/application-security/hugg ing-face-ai-platform-100-malicious-code-execution-models, Feb 2024

    2024

  16. [24]

    Malicious AI Models on Hugging Face Exploit Novel A ttack Technique,

    K. Poireault, “Malicious AI Models on Hugging Face Exploit Novel A ttack Technique,” https://www.infosecurity-magazine.com/news/malicio us-ai-models-hugging-face/, 2025, [Accessed 09-11-2025]

    2025

  17. [25]

    Federal Register :: Request Access,

    “Federal Register :: Request Access,” https://www.federalregister.gov/do cuments/2023/11/01/2023-24283/safe-secure-and-trustworthy-develop ment-and-use-of-artificial-intelligence, 2023, [Accessed 09-11-2025]

    2023

  18. [26]

    cve.org,

    “cve.org,” https://www.cve.org/CVERecord/SearchResults?query=pick le, 2025, [Accessed 09-11-2025]

    2025

  19. [27]

    Pickleball: Secure deserialization of pickle-based machine learning models (extended report),

    A. D. Kellas, N. Christou, W. Jiang, P. Li, L. Simon, Y . David, V . P. Kemerlis, J. C. Davis, and J. Yang, “Pickleball: Secure deserialization of pickle-based machine learning models (extended report),” 2025. [Online]. Available: https://arxiv.org/abs/2508.15987

    2025

  20. [28]

    How to make hugging face to hug worms: Discovering and exploiting unsafe pickle.loads over pre-trained large model hubs - blackhat asia 2024,

    P. Zhou, “How to make hugging face to hug worms: Discovering and exploiting unsafe pickle.loads over pre-trained large model hubs - blackhat asia 2024,” https://blackhat.com/asia-24/briefings/schedule/inde x.html#how-to-make-hugging-face-to-hug-worms-discovering-and-exp loitin...

    2024

  21. [29]

    coldwaterq/sectest - model card,

    coldwaterq, “coldwaterq/sectest - model card,” https://huggingface.co/c oldwaterq/sectest, 2024, [Accessed 12-03-2026]

    2024

  22. [30]

    zpbrent/reuse - model card,

    zpbrent, “zpbrent/reuse - model card,” https://huggingface.co/zpbrent/r euse, 2024, [Accessed 12-03-2026]

    2024

  23. [31]

    The art of hide and seek: Making pickle-based model supply chain poisoning stealthy again,

    T. Liu, G. Meng, P. Zhou, Z. Deng, S. Yao, and K. Chen, “The art of hide and seek: Making pickle-based model supply chain poisoning stealthy again,” 2025. [Online]. Available: https://arxiv.org/abs/2508.19774

    2025 arXiv

  24. [32]

    Backdooring pickles: A decade only made things worse - defcon 30,

    Coldwaterq, “Backdooring pickles: A decade only made things worse - defcon 30,” https://media.defcon.org/DEF%20CON%2030/DEF%20 CON%2030%20presentations/ColwaterQ%20-%20Backdooring%20 Pickles%20A%20decade%20only%20made%20things%20worse.pdf, [Accessed 13-04-2026]

  25. [33]

    Sour pickles - blackhat us 2011,

    “Sour pickles - blackhat us 2011,” https://media.blackhat.com/bh-us-11/ Slaviero/BH US 11 Slaviero Sour Pickles WP.pdf, 2011, [Accessed 13-04-2026]

    2011

  26. [34]

    Cwe - cwe-502: Deserialization of untrusted data (4.20),

    “Cwe - cwe-502: Deserialization of untrusted data (4.20),” https://cwe. mitre.org/data/definitions/502.html, [Accessed 20-06-2026]

    2026

  27. [35]

    flawed.net.nz — flawed.net.nz,

    flawednet, “flawed.net.nz — flawed.net.nz,” https://flawed.net.nz/2021/ 02/02/PyPI-Security-State/, 2021, [Accessed 17-06-2026]

    2021

  28. [36]

    Secure pypi? the problem with trusting open source reposi- tories — activestate.com,

    D. Crane, “Secure pypi? the problem with trusting open source reposi- tories — activestate.com,” https://www.activestate.com/blog/secure-pyp i-the-problem-with-trusting-open-source-repositories/, 2022, [Accessed 17-06-2026]

    2022

  29. [37]

    Cwe - cwe-1395: Dependency on vulnerable third-party component (4.20),

    “Cwe - cwe-1395: Dependency on vulnerable third-party component (4.20),” https://cwe.mitre.org/data/definitions/1395.html, [Accessed 20-06-2026]

    2026

  30. [38]

    Cwe - cwe-183: Permissive list of allowed inputs (4.20),

    “Cwe - cwe-183: Permissive list of allowed inputs (4.20),” https://cwe. mitre.org/data/definitions/183.html, [Accessed 20-06-2026]

    2026

  31. [39]

    Cwe - cwe-184: Incomplete list of disallowed inputs (4.20),

    “Cwe - cwe-184: Incomplete list of disallowed inputs (4.20),” https: //cwe.mitre.org/data/definitions/184.html, [Accessed 20-06-2026]

    2026

  32. [40]

    weights only unpickler.py – pytorch,

    P. Contributors, “weights only unpickler.py – pytorch,” https://github.c om/pytorch/pytorch/blob/main/torch/ weights only unpickler.py, 2025, github repository, Accessed: 07-01-2026

    2025

  33. [41]

    Zollllldont download this2 - model card,

    Zolllll, “Zollllldont download this2 - model card,” https://huggingface. co/Zolllll/dont download this2, 2026, [Accessed 09-03-2026]

    2026

  34. [42]

    “dont download this

    Zolllll, ““dont download this”,” https://huggingface.co/Zolllll/dont d ownload this, 2025, accessed: 2025-11-10

    2025

  35. [43]

    picklescan: Security scanner detecting python pickle files performing suspicious actions,

    mmaitre314, “picklescan: Security scanner detecting python pickle files performing suspicious actions,” https://github.com/mmaitre314/picklesc an, 2025, gitHub repository, accessed: 07-01-2026

    2025

  36. [44]

    Modelscan: Protection against model serialization attacks,

    P. AI, “Modelscan: Protection against model serialization attacks,” https: //github.com/protectai/modelscan, 2025, gitHub repository, accessed: 07-01-2026

    2025

  37. [45]

    A large-scale exploit instrumentation study of ai/ml supply chain attacks in hugging face models,

    B. Casey, J. C. S. Santos, and M. Mirakhorli, “A large-scale exploit instrumentation study of ai/ml supply chain attacks in hugging face models,” 2024. [Online]. Available: https://arxiv.org/abs/2410.04490

    2024 arXiv

  38. [46]

    pickletools - tools for pickle developers - docs.python.org,

    Python, “pickletools - tools for pickle developers - docs.python.org,” https://docs.python.org/3/library/pickletools.html, 2011

    2011

  39. [47]

    zlib — compression compatible with gzip - docs.python.org,

    “zlib — compression compatible with gzip - docs.python.org,” https: //docs.python.org/3/library/zlib.html, 1995, [Accessed 16-03-2026]

    1995

  40. [48]

    Fickling: A python pickling decompiler and static analyzer,

    T. of Bits, “Fickling: A python pickling decompiler and static analyzer,” https://github.com/trailofbits/fickling, 2025, gitHub repository, accessed: 07-01-2026

    2025

  41. [49]

    strace, “strace,” https://github.com/strace/strace, 1991, [Accessed 07- 01-2026]

    1991

  42. [50]

    CPython: The python programming language,

    P. Developers, “CPython: The python programming language,” https: //github.com/python/cpython, 1991, gitHub repository, accessed 07-01- 2026

    1991

  43. [51]

    Dont download this - opencsg - model card,

    zol, “Dont download this - opencsg - model card,” https://opencsg.co m/models/zol/Dont download this?tab=files&actionName=files&branc h=main, 2026, [Accessed 09-04-2026]

    2026

  44. [52]

    The python package index — pypi.org,

    PyPI, “The python package index — pypi.org,” https://pypi.org, 2026, [Accessed 07-01-2026]

    2026

  45. [53]

    Moduleguard: Understanding and detecting module conflicts in python ecosystem,

    R. Zhu, X. Wang, C. Liu, Z. Xu, W. Shen, R. Chang, and Y . Liu, “Moduleguard: Understanding and detecting module conflicts in python ecosystem,” inProceedings of the IEEE/ACM 46th International Conference on Software Engineering, ser. ICSE ’24. New York, NY , USA: Association ...

    2024

  46. [54]

    Reference for ultralytics/utils/patches.py — docs.ultralytics.com,

    Ultralytics, “Reference for ultralytics/utils/patches.py — docs.ultralytics.com,” https://docs.ultralytics.com/reference/utils /patches/, [Accessed 29-04-2026]

    2026

  47. [55]

    Synthyraesm2-8m hugging face - huggingface.co,

    Synthyra, “Synthyraesm2-8m hugging face - huggingface.co,” https://hu ggingface.co/Synthyra/ESM2-8M, 2025, [Accessed 05-03-2026]

    2025

  48. [56]

    Full text search - hugging face — huggingface.co,

    H. Face, “Full text search - hugging face — huggingface.co,” https: //huggingface.co/search/full-text?q=requirements.txt&type=model&type =dataset, 2026, [Accessed 05-03-2026]

    2026

  49. [57]

    fakespot-ai/roberta-base-ai-text-detection-v1 - hugging face — huggingface.co,

    fakespot ai, “fakespot-ai/roberta-base-ai-text-detection-v1 - hugging face — huggingface.co,” https://huggingface.co/fakespot-ai/roberta-base-ai-t ext-detection-v1, 2025, [Accessed 06-03-2026]

    2025

  50. [58]

    shivaneej, “Github - shivaneej/genessay: Genessay is a content genera- tion system where the user can enter incomplete sentences and phrases and the system will generate the content according to the input — github.com,” https://github.com/shivaneej/Genessay/tree/master, 2020, ...

    2020

  51. [59]

    Llama3-agentflan-adapter — modelscope.cn,

    modelscope, “Llama3-agentflan-adapter — modelscope.cn,” https://ww w.modelscope.cn/models/fanqiNO1/Llama3-AgentFLAN-Adapter/sum mary, 2024, [Accessed 06-03-2026]

    2024

  52. [60]

    Github - swisskyrepo/payloadsallthethings: A list of use- ful payloads and bypass for web application security and p entest/ctf — github.com,

    swisskyrepo, “Github - swisskyrepo/payloadsallthethings: A list of use- ful payloads and bypass for web application security and p entest/ctf — github.com,” https://github.com/swisskyrepo/PayloadsAllTheThings, 2019, [Accessed 27-01-2026]

    2019

  53. [61]

    Online - reverse shell generator — revshells.com,

    revshells, “Online - reverse shell generator — revshells.com,” https: //www.revshells.com, 2026, [Accessed 27-01-2026]

    2026

  54. [62]

    Adds dataflow analysis, generalizes constant opcodes, and cleans up injection by esultanik · pull request #28 · trailofbits/fickling — github.com,

    T. O. Bits, “Adds dataflow analysis, generalizes constant opcodes, and cleans up injection by esultanik · pull request #28 · trailofbits/fickling — github.com,” https://github.com/trailofbits/fickling/pull/28, 2022, [Accessed 06-04-2026]

    2022

  55. [63]

    Trail of bits — trailofbits.com,

    T. of Bits, “Trail of bits — trailofbits.com,” https://www.trailofbits.com, 2012, [Accessed 07-01-2026]

    2012

  56. [64]

    Welcome to fastai – fastai,

    fastai, “Welcome to fastai – fastai,” https://docs.fast.ai, [Accessed 15- 04-2026]

    2026

  57. [65]

    Github - columbia/pickleball: Pickleball protects users from dangerous pickle-based ml models — github.com,

    “Github - columbia/pickleball: Pickleball protects users from dangerous pickle-based ml models — github.com,” https://github.com/columbia/pi ckleball, 2025, [Accessed 02-04-2026]

    2025

  58. [66]

    Github - s2e-lab/hf-model-analyzer - modeltracer,

    “Github - s2e-lab/hf-model-analyzer - modeltracer,” https://github.com /s2e-lab/hf-model-analyzer, 2025, [Accessed 25-03-2026]

    2025

  59. [67]

    Raft - pypi,

    “Raft - pypi,” https://pypi.org/project/raft/, 2024, [Accessed 17-04- 2026]

    2024

  60. [68]

    Dont download this model - modelscope - model card,

    zoltester, “Dont download this model - modelscope - model card,” ht tps://www.modelscope.cn/models/zoltester/Dont download this model, 2026, [Accessed 09-04-2026]

    2026

  61. [69]

    Shadowpickle-bench/dont download this - github.com,

    “Shadowpickle-bench/dont download this - github.com,” https://github .com/ShadowPickle-Bench/Dont Download This, 2026, [Accessed 16-04-2026]

    2026

  62. [70]

    Github - dashingsoft/pyarmor: A tool used to obfuscate python scripts , bind obfuscated scripts to fixed machine or expire obfus- cated scripts. — github.com,

    dashingsoft, “Github - dashingsoft/pyarmor: A tool used to obfuscate python scripts , bind obfuscated scripts to fixed machine or expire obfus- cated scripts. — github.com,” https://github.com/dashingsoft/pyarmor, 2025, [Accessed 27-01-2026]

    2025

  63. [71]

    Github - nyudenkov/pysentry: Scan your python depen- dencies for known security vulnerabilities with rust-powered scanner - github.com,

    nyudenkov, “Github - nyudenkov/pysentry: Scan your python depen- dencies for known security vulnerabilities with rust-powered scanner - github.com,” https://github.com/nyudenkov/pysentry, 2025, [Accessed 08-04-2026]

    2025

  64. [72]

    Github - splitline/pickora: A toy compiler that can convert python scripts to pickle bytecode,

    “Github - splitline/pickora: A toy compiler that can convert python scripts to pickle bytecode,” https://github.com/splitline/Pickora, [Accessed 30-06-2026]

    2026

  65. [73]

    Github - security-pride/malhug,

    “Github - security-pride/malhug,” https://github.com/security-pride/Mal Hug, [Accessed 30-06-2026]. Listing 3:external.pyfile, showing the function dangerous_func def dangerous_func(cmd): exec(cmd) APPENDIX A. Open Science The artifact website contains the official repository ...

    2026

  66. [74]

    /bin/bash

    Step 1 - Crawling:From a selected model hub, we choose a task tag from the most commonly occuring task tags. In our evaluation, we use Hugging Face and the text-generation task tag as it includes the highest number of models, as illustrated in Table XVI. We obtain a list of re...

  67. [75]

    The collected payloads are Pickled into self-contained files, such that they can be directly injected into PyTorch models, as they are both binary data with the same set of opcodes

    Step 2 - Payload Generation:We collect a set of real-world payloads (20), including reverse shells and data exfiltration fromrevshells.com[61], PayloadsAllTheThings[60], etc. The collected payloads are Pickled into self-contained files, such that they can be directly injected ...

  68. [76]

    We then edit the memory addresses of the injecting Pickle file to be greater than TABLE XVII: Open-source SOTA’s performance on SHADOWPICKLEvs

    Step 3 - Payload Injection:From the set of payload- injected Pickles in the previous step (step 3), we randomly sample a payload Pickle to be injected into the downloaded PTMs from the Crawling step (step 1). We then edit the memory addresses of the injecting Pickle file to be...

  69. [77]

    cat /etc/passwd

    Step 4 - Scanning:Finally, we evaluate the curated dynamic benchmark (PICKLEBENCH) against the SOTA open- source scanners. The goal is to examine the performance of the scanners on PICKLEBENCH. We feed each model in PICKLEBENCHto be scanned by each scanner. The scanner’s verdi...

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.