# Suspicious Functions

## Detection Summary

The model file contains code functions that could be used to enable malicious behavior.

## Security Impact

While not inherently malicious, these functions can be abused to perform actions such as code execution.

## False Positive Considerations

Detected functions can be used legitimately and not with malicious intent.

## Recommended Remediation

- Treat the model as untrusted.
- Engage the team responsible for the development and deployment of the model, letting them know the nature of the detection so the detected code can be reviewed and the implications of loading it can be fully understood.
- Have somebody with the appropriate technical skills statically analyze the file to determine whether or not this is a security concern.
- If necessary, have a member of the security team work with the application team to deploy the model in a sandboxed environment to observe behaviour.
- If the detected code function(s) cannot be confirmed as legitimate, the model should be discarded.
- If this model has already been loaded, have the security team review the code associated with the detection in order to understand the impact and determine the best way to handle the incident based on existing procedures and policy.
- Remove the model from the production pipeline if necessary, ensuring the business and operational impact of removal is mitigated.