Local AI Models Face Pickle-Based Code Execution and Triggered-Behavior Risks
Summary
The article explains how pickle-serialized model files can execute code and how fine-tuned models may exhibit trigger-dependent behavior. It cites security research and recommends verified providers, SafeTensors, and hash checks.
Key points
- The article says pickle deserialization can execute embedded bytecode when a model is loaded, potentially without further user interaction.
- Protect AI reportedly identified more than 352,000 suspicious files across 51,700 models on Hugging Face; the article says over 80% of models in the ecosystem used pickle serialization.
- Rapid7 documented weaponized .pth files that deployed Go-based remote access trojans through Cloudflare Tunnels, according to the article.
- JFrog reportedly found three zero-day bypasses in PickleScan; the article describes attackers manipulating file structure to evade scanning.
- The article reports that CrowdStrike found DeepSeek-R1 generated more severe vulnerabilities in some politically sensitive prompt contexts and sometimes refused to generate code for Falun Gong-related prompts.
- Recommended precautions are downloading from verified providers, preferring SafeTensors files, and checking model hashes against official listings.
Article Details
- Topic
- Supply-chain security risks in locally hosted AI models, including malicious pickle files and fine-tuned sleeper agents
Products
DeepSeek-R1CrowdStrike documented that DeepSeek-R1 generates code with up to 50% more severe vulnerabilities when the prompt contains topics the CCP considers politically sensitive, things like references to Tibet, UyghurHugging FaceMitigations are simple and effective: download from verified providers on Hugging Face, prefer SafeTensors format, and verify model hashes to eliminate the vast majority of threats.