# Suspicious File Format

## Detection Summary

The model file contains a mismatch between the stated protocol level and the protocol level of instructions found within the file.

## Security Impact

The model may have been tampered with in a manner that enables attacks such as arbitrary code execution.

## False Positive Considerations

Protocol mismatch could exist legitimately, for example as a result of backwards compatibility requirements.

## Recommended Remediation

- Treat the model as untrusted.
- Engage the team responsible for the development and deployment of the model, letting them know the nature of the detection.
- Have somebody with the appropriate technical skills statically analyze the file to determine the cause for the mismatch and whether or not this is a security concern.
- If necessary, have a member of the security team work with the application team to deploy the model in a sandboxed environment to observe behaviour.
- If the reason for the mismatch is determined to be a security concern, the model should be discarded.
- If this model has already been loaded, have the security team review the code associated with the detection in order to understand the impact and determine the best way to handle the incident based on existing procedures and policy.
- Remove the model from the production pipeline if necessary, ensuring the business and operational impact of removal is mitigated.