Deep dive into the abuse of DL APIs to create malicious AI models and how to detect them

Thursday 25 September 16:00 - 16:30, Green room

Mohamed Nabeel & Alex Starov (Palo Alto Networks)

According to Gartner, more than 70% of organizations will have integrated AI models in their workflows by the end of 2025. In order to reduce cost and foster innovation, it is often the case that pretrained models are fetched from model hubs like Hugging Face or TensorFlow Hub. However, this introduces a security risk where attackers can inject malicious code into the models they upload to these hubs, leading to various kinds of attacks including remote code execution (RCE), sensitive data exfiltration, and system file modification when these models are loaded or executed (predict function). Since AI models play a critical role in the digital transformation, this would, unfortunately, drastically increase the number of software supply chain attacks.

While there are several efforts at detecting malware when deserializing Pickle-based saved models (hiding malware in model parameters), the risk of abusing DL APIs (e.g. TensorFlow APIs) is understudied. Specifically, we show how one can abuse hidden functionality of TensorFlow APIs, such as file read/write and network send/receive, along with their persistence APIs, to launch attacks.

It is concerning to note that existing scanners in model hubs like Hugging Face and TensorFlow Hub are unable to detect some of the stealthy abuse of such APIs. This is because scanning tools like Flicking and ModelScan face challenges in semantic-level analysis and in-depth taint analysis. We also show how one may identify potentially abusable hidden API capabilities using LLMs and build scanners to detect such abuses.

Back to VB2025 Programme page

Back to VB2025 conference page

Other VB2025 papers