| Advisory | Estimated Severity | Definition | Rationality for Severity |
|---|---|---|---|
Suspicious File Format | Medium | Adversaries can modify data structures and encodings in an attempt to evade detection. Expand for File InformationModel Format and File Extensions:
| File format tampering is usually indicative of a targeted attack. Expand for More Information
|
| TokenBreak | High | Adversaries can exploit a weakness in the tokenizer to bypass model classifications. | Models susceptible to the tokenbreak vulnerability can have their classifications altered on command by an attacker resulting in a weakness wherever the model is used. |
Model Reference | Low | Containers may reference external model artifacts or require model selection at runtime. NIM container scans emit advisory | This advisory is informational. Understanding model references helps inventory supply chain dependencies and deployment configuration. Misconfigured or unexpected model references may indicate an incomplete deployment or an opportunity to scan referenced artifacts for security issues. Expand for More Information
|
| Detection | Estimated Severity | Definition | Rationality for Severity |
|---|---|---|---|
Arbitrary Code Execution | Critical | Adversaries can inject malicious code into a model, which will be executed whenever the hijacked model is loaded into memory. This vulnerability can be used to exfiltrate sensitive data, execute malware (such as spyware or ransomware) on the machine, or run any kind of malicious scripts. Expand for File InformationModel Format and File Extensions:
| Arbitrary code execution attacks are relatively easy to perform and may lead to critical outcomes such as execution of malicious code on an organization's computers. Expand for More Information
|
Arbitrary Read Access | High | Adversaries can craft a malicious model that will exfiltrate sensitive data upon loading. Expand for File InformationModel Format and File Extensions:
| Arbitrary read access attacks are relatively easy to perform and may lead to critical outcomes such as an attacker exfiltrating sensitive data. Expand for More Information
|
Control Vector | High | Adversaries can inject a control vector into the computational graph of a model introducing refusal ablation or custom, attacker-defined behaviors. Expand for File InformationModel Format and File Extensions:
| Inserted control vectors can control or modify model behavior as well as can be used to remove refusals on a secured model. Expand for More Information
|
Decompression Vulnerabilities | High | Adversaries can exploit vulnerabilities in popular compression formats to cause denial of service or leak sensitive data. Expand for File InformationModel Format and File Extensions:
| Decompression vulnerabilities are relatively easy to exploit and may lead to high-impact outcomes such as denial of service, code execution, or data leakage. Expand for More Information
|
Denial of Service | Medium | Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to disrupt the system the model will be loaded on. Expand for File InformationModel Format and File Extensions:
| Denial of service attacks are relatively easy to perform and may lead to disruption or degradation of service. Expand for More Information
|
Directory Traversal | Medium | Adversaries can craft a malicious model, or modify legitimately pre-trained model, in order to gain unauthorised access to sensitive files on the system. Expand for File InformationModel Format and File Extensions:
| Directory traversal attacks are relatively easy to perform and may grant an attacker access to sensitive files on the file system. Expand for More Information
|
Embedded Payloads | Low | Adversaries can embed malicious payloads (such as backdoors, coin miners, spyware, and ransomware) inside the model’s tensors. Such payloads can be injected in plain text, obfuscated, or embedded using steganography. Expand for File InformationModel Format and File Extensions:
| Malicious payloads can be embedded in ML models relatively easily; this may lead to malware components being distributed on an organization's computers. Expand for More Information
|
Graph Payload | High | Adversaries can inject a computational graph payload, introducing a secret attacker-controlled behavior into a pre-trained model. Note: ONNX files without graph is an advisory. Expand for File InformationModel Format and File Extensions:
| Model backdooring may be relatively difficult to perform and can lead to critical outcomes such as biased or inaccurate output. Expand for More Information
|
Model Sideloading | High | Adversaries can load code or model artifacts from an unexpected location bypassing checks performed on the model. Expand for File InformationModel Format and File Extensions:
| Model sideloading is not expected behavior and typically points to an attempt to obfuscate a payload. |
Network Requests | High | Adversaries can craft a malicious model that will make network requests upon loading. Expand for File InformationModel Format and File Extensions:
| Network requests are relatively easy to perform and may be used to exfiltrate data, download payloads, or initiate command and control communications. Expand for More Information
|
Repository Sideloading | Medium | Adversaries can load code or model artifacts from an unexpected location, bypassing checks performed on the artifacts in the repository. | Repository sideloading is an expected behavior allowed by Hugging Face; however, it can be abused to bypass security checks. Expand for More Information
|
Suspicious Functions | High | The presence of these functions themselves is not inherently malicious, but they can be used in conjunction with other functions to create a malicious model. Expand for File InformationModel Format and File Extensions:
| Functions can be used in conjunction with other functions to create a malicious model. Expand for More Information
|