> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiddenlayer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Finding Classification AI Supply Chain Security findings include detections and advisories. Each finding is described by a category, a threat level, and a threat type. These answer different questions: what was found, how severe it is, and how the finding is classified. Policy evaluation separately determines whether a scan is compliant. > [!NOTE] > > Threat-classification availability depends on the scanner build and deployment. See [Scan Report](https://docs.hiddenlayer.ai/docs/products/supply-chain/scan-results/scan_report.md#cli-and-api-availability) for enablement and compatibility details. ## Threat levels Findings can have a Critical, High, Medium, or Low threat level. Threat level belongs to the individual rule, not the category as a whole. The table lists the exact values used by active rules; a list is not a continuous range. For example, Embedded Payloads has Low and Critical findings, not every threat level between them. ## Threat types | Threat type | Meaning | | - | - | | Malicious | A finding indicative of an attack; do not use the affected model. | | Suspicious | A finding that may be legitimate but warrants review before use. | | Vulnerable | A known vulnerability that an attacker could exploit. | | Advisory | A finding requiring attention or review that is not necessarily a threat. | Threat type is independent of threat level. A suspicious finding can be Critical. A category can contain more than one threat type, so categories are not divided into detection-only and advisory-only lists. Detections and advisories are the report's finding collections; threat type does not determine which collection contains a finding, and an advisory can carry a threat level. See [Scan Report](https://docs.hiddenlayer.ai/docs/products/supply-chain/scan-results/scan_report.md#understanding-scan-results) for collection placement, counts, legacy unclassified findings, and scan-level summaries. ## Categories | Category and remediation | Threat Levels | Threat types | | - | - | - | | [Arbitrary Code Execution](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/arbitrary_code_execution.md) | High, Critical | Malicious, Suspicious | | [Arbitrary Read Access](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/arbitrary_read_access.md) | Medium, High | Malicious, Suspicious | | [Decompression Vulnerabilities](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/decompression_vulnerabilities.md) | High | Malicious, Suspicious | | [Denial of Service](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/denial_of_service.md) | Low, Medium, High | Malicious, Suspicious | | [Directory Traversal](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/directory_traversal.md) | Medium, High, Critical | Malicious, Suspicious | | [Embedded Credentials](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/embedded_credentials.md) | Medium, High | Vulnerable | | [Embedded Payloads](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/embedded_payloads.md) | Low, Critical | Suspicious | | [Graph Payload](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/graph_payloads.md) | Medium, High, Critical | Malicious, Suspicious | | [Model Reference](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/model_reference.md) | Low | Advisory | | [Model Tampering](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/model_tampering.md) | Medium, High | Malicious, Suspicious | | [Network Requests](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/network_requests.md) | High | Malicious | | [Out of Bounds Memory Read Access](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/out_of_bounds_memory_read_access.md) | Medium, High | Suspicious | | [Out of Bounds Memory Write Access](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/out_of_bounds_memory_write_access.md) | Critical | Malicious | | [Repository Sideloading](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/repository_sideloading.md) | Critical | Suspicious | | [Suspicious File Format](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/suspicious_file_format.md) | Low, Medium, Critical | Suspicious, Advisory | | [Suspicious Functions](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/suspicious_functions.md) | Critical | Suspicious | | [Tokenizer Tampering](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/tokenizer_tampering.md) | High, Critical | Malicious, Suspicious | | [Tokenizer Vulnerabilities](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/tokenbreak.md) | High | Vulnerable | ## Category details ### Arbitrary Code Execution Model content can invoke code or exploit a loader or template renderer. Findings include executable functions, embedded PyTorch in Keras, and XML external entities in PMML. Review the evidence: suspicious code capability does not by itself establish malicious intent. ### Arbitrary Read Access Keras/HDF5 external storage references or external links can cause a reader to access host files, including paths outside the model directory. ### Decompression Vulnerabilities Compressed content can expand disproportionately or exhaust resources during extraction. Archive path traversal is covered by Directory Traversal. ### Denial of Service Functions, XML content, or model structures can terminate processing or demand excessive memory, computation, or traversal. Some findings identify a reader resource limit rather than a confirmed attack. ### Directory Traversal Model references or archive entries can access paths outside the expected directory. Includes ONNX external-data paths and TAR/ZIP Slip attacks that can overwrite host files. ### Embedded Credentials Model-associated JSON contains a credential-shaped string or a high-entropy value in a secret-like field. Matches are not validated with the issuing service; review and rotate exposed credentials. ### Embedded Payloads File content includes executable signatures, test-malware patterns, or other possible payloads. A pattern match requires investigation and does not establish that the payload will execute. ### Graph Payload Computational graph patterns can indicate hidden behavior or a neural backdoor. Findings include heuristic graph patterns and control-vector-related behavior; review model provenance and intended behavior. ### Model Reference A container references external model artifacts or requires model selection at runtime. Referenced artifacts are not scanned automatically; download and scan them separately. ### Model Tampering Model files differ from a signature manifest, the signature cannot be validated, or files are outside signature coverage. An invalid signature can also result from the wrong verification key. ### Network Requests Functions or libraries can make outbound requests, enabling data exfiltration, payload downloads, or communications with an attacker. ### Out of Bounds Memory Read Access Tensor metadata or payload lengths can cause a vulnerable reader to access memory outside the intended buffer, potentially disclosing adjacent memory. ### Out of Bounds Memory Write Access Tensor data contains more elements than its declared dimensions allow. A vulnerable reader can copy attacker-controlled data beyond the destination buffer. ### Repository Sideloading Configuration JSON uses auto\_map to load additional classes. References may resolve to code outside the model repository and require review before use. ### Suspicious File Format Unexpected structures, protocol mismatches, missing graphs, or inspection limits require review. Findings can identify malformed content, incomplete analysis, or format features that need attention. ### Suspicious Functions Functions can execute code or return callable objects. Their presence warrants review of how they are used and combined. ### Tokenizer Tampering Duplicate token IDs, unsafe orphan tokens, or discrepancies in tokenizer artifacts can alter how text is encoded or decoded. ### Tokenizer Vulnerabilities BPE and WordPiece tokenization strategies can be susceptible to TokenBreak, allowing manipulated inputs to change model classifications. Format coverage depends on the rule and scanner version. Category descriptions identify representative inputs, not a guarantee that every supported format is checked for every category. See [Supported model formats](https://docs.hiddenlayer.ai/docs/products/supply-chain/cli/supported_model_formats.md) for scanner format support. ### Related techniques and previous category names TokenBreak is documented under Tokenizer Vulnerabilities. Control-vector findings are included in Graph Payload; see [Control Vector remediation](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/control_vector.md) for technique-specific guidance. Model Sideloading is not an active category in this release; its [historical remediation guidance](https://docs.hiddenlayer.ai/docs/products/supply-chain/remediation-guide/model_sideloading.md) remains available for older results. ### Further reading * [R-bitrary Code Execution](https://hiddenlayer.com/research/r-bitrary-code-execution/) * [Security Advisory: 2024-06-skops](https://hiddenlayer.com/sai-security-advisory/2024-06-skops/) * [Models are Code](https://hiddenlayer.com/research/models-are-code/) * [HiddenLayer Tech Blog: ONNX Vulnerability Report](https://hiddenlayer.com/sai-security-advisory/2024-02-onnx/) * [Weaponizing Machine Learning Models with Ransomware](https://hiddenlayer.com/research/weaponizing-machine-learning-models-with-ransomware/) * [Pickle Files](https://hiddenlayer.com/research/pickle-strike/)