Boyan Milanov

Summary: Trail of Bits added an allowlist-based pickle file scanner to Fickling to protect AI/ML environments from malicious pickle files that could compromise models or infrastructure. The same author previously detailed Sleepy Pickle, a hybrid ML model exploitation technique that abuses the insecure Pickle format used to package and distribute ML models, and released Datasig for fingerprinting AI/ML datasets to detect data-borne vulnerabilities.
Bottom line: The Pickle format remains the standard way ML models are packaged and shared, and Sleepy Pickle showed a malicious file can stealthily compromise a model and persist undetected on the systems that deploy it.

Read the original at Trail of Bits Blog ↗