This document contains guidance and recommendations for application teams to better understand the potential impact and next steps for handling detections raised through AI Supply Chain Security. It should be used in conjunction with the model file’s Detection Summary details, relevant MITRE ATLAS techniques, and supporting technical documentation available in the Console to ensure full context when assessing a finding.
Each section within this document outlines recommended remediation strategies per detection category to support timely response. If additional investigation is required, teams should escalate in accordance with their organization’s established protocols and procedures to ensure appropriate involvement of designated decision-makers and stakeholders.
Each category includes a Detection Summary describing the detection and a Security Impact section describing potential security and business implications if exploitation occurs. The guide also outlines False Positive (or Risk) Considerations, defining criteria to assess whether a detection may be a false positive, and provides Recommended Remediation as high-level guidance based on the detection category.
| Detection | Description |
|---|---|
| Arbitrary Code Execution | This detection indicates that a model file contains code that will be executed when the model is loaded into memory. |
| Arbitrary Read Access | The model appears capable of reading files or data from the host system when loaded. |
| Control Vector | The computational graph contains artifacts consistent with the insertion of a control vector into the model’s computational graph, which may alter or override expected model behavior. |
| Decompression Vulnerabilities | The model uses compression formats in a way that may trigger denial of service or data leakage. |
| Denial of Service | The model may cause excessive resource consumption or deliberate process termination when loaded. |
| Directory Traversal | The model may attempt to access files outside its expected directory structure. |
| Embedded Payloads | The model contains embedded data that may represent malicious payloads. |
| Graph Payloads | The model’s computational graph may include hidden attacker-controlled behavior. |
| Model Sideloading | The model file exhibits behavior consistent with loading code or model artifacts from an unexpected or external location, bypassing standard model loading and validation processes. |
| Model Reference | The container references external model artifacts or requires model selection at runtime. |
| Network Requests | The model may attempt to make outbound network requests when loaded or executed. |
| Repository Sideloading | This detection indicates that a model or related code may be loading artifacts from an unexpected or untrusted location rather than the intended repository or source. |
| Suspicious File Format | The model file contains a mismatch between the stated protocol level and the protocol level of instructions found within the file. |
| Suspicious Functions | The model file contains code functions that could be used to enable malicious behavior. |
| TokenBreak | The model is using a tokenizer type that is vulnerable to the TokenBreak attack technique, where prefixes can be added to a word to alter how inputs are tokenized, changing semantic understanding. Attackers can leverage this to manipulate model outputs for classification, predictive and generative models. |
| Tokenizer Tampering | The model's tokenizer.json contains two or more tokens that share the same token ID. An attacker can add a malicious token with the same ID as an existing one, giving them control over what text the model outputs for that ID. |