The model may attempt to access files outside its expected directory structure.
Directory traversal can expose sensitive system files or application secrets.
Verify whether paths are static and controlled, or have deliberately been used by a trusted model creator.
- Do not load or deploy the affected model. It should be isolated from production systems.
- Engage the team responsible for the development and deployment of the model, letting them know the nature of the detection. Safely examine the external tensor data and confirm with the model creator whether the specified file path is expected. If the model creator confirms this is deliberate and legitimate, to avoid future detections, best practice would be for models to only load data from within the working directory using relative paths.
- If the referenced file path cannot be confirmed as legitimate, the model should be discarded.
- If this model has already been loaded, have the security team review the tensor data associated with the detection in order to understand the impact and determine the best way to handle the incident based on existing procedures and policy.
- Remove the model from the production pipeline if necessary, ensuring the business and operational impact of removal is mitigated.