Fickling’s new AI/ML pickle file scanner

Summary: Trail of Bits released new features for Fickling, its pickle file scanner and decompiler, that use an explicit allowlist of safe imports rather than a list of known dangerous ones, and can be enabled with a single line of code that hooks the pickle module. The team built the ML allowlist from 3,000 pickle files in top Hugging Face repositories and reports that in its benchmark Fickling caught 100% of malicious files and correctly classified 99% of safe files, after confirming that an undetected malicious pickle file could be uploaded to a Hugging Face test repository.
What you should know: Existing scanners that check for hard-coded unsafe imports can be circumvented, and Trail of Bits demonstrated this by uploading a malicious pickle file to Hugging Face that current tools did not detect. Any model your teams pull from a public hub arrives through a format whose default behavior is remote code execution.

Read the original at Trail of Bits Blog ↗