Never a dill moment: Exploiting machine learning pickle files

Summary: Trail of Bits researchers detail how Python pickle files, the format behind many machine learning models, contain GLOBAL and REDUCE opcodes that can execute arbitrary Python code during deserialization, and none of the ML libraries they inspected define a custom unpickler to limit this. They released an open-source tool called Fickling that symbolically executes pickle files to decompile and analyze them, and demonstrated a proof-of-concept that injects code into a PyTorch model to list and exfiltrate files from the current directory.
Key Takeaway: The PyTorch maintainers, contacted on January 25th and replied to two days later, said they will consider adding warnings but do not background-check model publishers or audit code, leaving the onus on users to verify provenance - which the researchers argue is insufficient against typosquatting and supply chain attacks that can inject code into a legitimate model while its source code appears benign.

Read the original at Trail of Bits Blog ↗