Unpickling PyTorch Security Risks and Mitigations

This technical report discusses the security risks associated with using pickle files in PyTorch, particularly in the context of open-source AI models. It outlines how the convenience of model sharing via the pickle format introduces vulnerabilities, as malicious code can be embedded within these files, executing silently upon loading. The report details the implicit trust model of pickle files and highlights the limitations of existing tools like picklescan, which have been found to have vulnerabilities that allow attackers to bypass their protections. Real-world examples of malware embedded in AI models are presented, demonstrating various techniques used by attackers to evade detection. The report emphasizes the need for enterprises to treat AI models as critical software components, advocating for rigorous security practices, including vulnerability scanning and policy enforcement. It concludes by stressing the importance of continuous updates to detection tools and the necessity of understanding adversarial misuse of serialization formats.