Malicious Model Artifacts

Downloaded model weights or adapters carry executable payloads via unsafe serialization formats such as pickle.

Impact

Loading the model executes attacker code on training clusters or inference hosts with access to data and credentials.

Why this severity

Impact High × Likelihood High = Critical

Impact high: code execution on training or serving hosts. Likelihood high: malicious models on Hugging Face and a compromised PyTorch dependency are documented incidents, and anyone can publish.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: Malicious Models on Hugging Face (MITRE ATLAS case study AML.CS0031, 2025)
Incident: Compromised PyTorch Dependency Chain (MITRE ATLAS case study AML.CS0015, 2022)
Demonstration: Model Namespace Reuse Supply Chain Attack (MITRE ATLAS case study AML.CS0065, 2025)

Exploits

Unsafe Model Deserialization Vulnerability · Critical severity
Unverified Data & Model Provenance Vulnerability · High severity

Follows from

Training & Fine-Tune Data Poisoning Threat · High severity

Mitigated by

Signed Model Registry & AIBOM Guardrail · Fixes critical risks

Remediation

Load only tensor-only formats (safetensors, GGUF) from untrusted sources.
Pin model revisions by content hash, never by mutable tag.
Scan artifacts in an isolated job before promotion to the registry.

How to verify

Attempt to load a pickle with an os.system payload and expect a hard failure.
Registry rejects artifacts whose digest differs from the signed manifest.

Pattern

model = load_file('model.safetensors')  # never torch.load(untrusted)

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM03:2025 Supply Chain

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

MITRE ATLAS

AML.T0010 AI Supply Chain Compromise
AML.T0011.000 User Execution: Unsafe AI Artifacts

NIST AI RMF 1.0

GOVERN 6.1 Policies address AI risks from third-party entities
MANAGE 3.2 Pre-trained models are monitored as part of regular maintenance