Model Scanner Detection Categories and Severity Levels

Copy

• Copy for LLM

  Copy page as Markdown for LLMs
• View as Markdown

  Open this page as Markdown
• Open in ChatGPT

  Get insights from ChatGPT
• Open in Claude

  Get insights from Claude
• Connect to Cursor

  Install MCP server on Cursor
• Connect to VS Code

  Install MCP server on VS Code

Arbitrary Code Execution

Critical

Adversaries can inject malicious code into a model, which will be executed whenever the hijacked model is loaded into memory. This vulnerability can be used to exfiltrate sensitive data, execute malware (such as spyware or ransomware) on the machine, or run any kind of malicious scripts.

Arbitrary code execution attacks are relatively easy to perform and may lead to critical outcomes such as execution of malicious code on an organization's computers.

Arbitrary Read Access

High

Adversaries can craft a malicious model that will exfiltrate sensitive data upon loading.

Arbitrary read access attacks are relatively easy to perform and may lead to critical outcomes such as an attacker exfiltrating sensitive data.

Decompression Vulnerabilities

High

Adversaries can exploit vulnerabilities in popular compression formats to cause denial of service or leak sensitive data.

Decompression vulnerabilities are relatively easy to exploit and may lead to high-impact outcomes such as denial of service, code execution, or data leakage.

Denial of Service

Medium

Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to disrupt the system the model will be loaded on.

Denial of service attacks are relatively easy to perform and may lead to disruption or degradation of service.

Directory Traversal

Medium

Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to gain unauthorised access to sensitive files on the system.

Directory traversal attacks are relatively easy to perform and may grant an attacker access to sensitive files on the file system.

Embedded Payloads

Low

Adversaries can embed malicious payloads (such as backdoors, coin miners, spyware, and ransomware) inside the model’s tensors. Such payloads can be injected in plain text, obfuscated, or embedded using steganography.

Malicious payloads can be embedded in ML models relatively easily; this may lead to malware components being distributed on an organization's computers.

Graph Payload

High

Adversaries can inject a computational graph payload, introducing a secret attacker-controlled behavior into a pre-trained model.

Model backdooring may be relatively difficult to perform and can lead to critical outcomes such as biased or inaccurate output.

Network Requests

High

Adversaries can craft a malicious model that will make network requests upon loading.

Network requests are relatively easy to perform and may be used to exfiltrate data, download payloads, or initiate command and control communications.

Repository Sideloading

Medium

Adversaries can load code or model artifacts from an unexpected location, bypassing checks performed on the artifacts in the repository.

Repository sideloading is an expected behavior allowed by Hugging Face; however, it can be abused to bypass security checks.

Suspicious File Format

Medium

Adversaries can modify data structures and encodings in an attempt to evade detection.

File format tampering is usually indicative of a targeted attack.

Suspicious Functions

High

The presence of these functions themselves is not inherently malicious, but they can be used in conjunction with other functions to create a malicious model.

Functions can be used in conjunction with other functions to create a malicious model.