Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Researchers at ReversingLabs have identified malicious models containing embedded malware hosted on the Hugging Face model repository. The models were found to execute reverse shells when loaded, which grants the threat actor command and control capabilities on the victim's system. Hugging Face uses Picklescan to scan models for malicious code, however these models were not flagged as malicious. The researchers discovered that the model files were seemingly purposefully corrupted in a way that the malicious payload is executed before the model ultimately fails to de-serialize fully. Picklescan relied on being able to fully de-serialize the model.
Since becoming aware of this issue, Hugging Face has removed the models and has made changes to Picklescan to catch this particular attack. However, pickle files are fundamentally unsafe as they allow for arbitrary code execution, and there may be other types of malicious pickles that Picklescan cannot detect.
ASSESSED SYSTEM
Representative configuration: the third-party model-consumption path ReversingLabs observed — a pickle-serialized model artifact published to a public Hugging Face repository, screened only by the hub's Picklescan scan, and loaded in-process by a Hugging Face user's model-loading environment with that user's own permissions and network access. Scored in the pre-disclosure state, before Hugging Face removed the models and changed Picklescan.
OUT OF SCOPE
Hugging Face's platform and Picklescan as they stand after the post-disclosure change; non-executable model formats and deployments that mandate them; any named victim (none is identified); the behaviour of the model weights, which is irrelevant to this failure mode; and the reverse-shell payload and its command-and-control host, which are attacker tooling.
Architecture: Traditional ML / Classifier (decision tree Q6) — Host-inheritance rule: the architecture is that of the AI workload the loaded artifact serves. The record establishes a pickle-serialized model consumed by Hugging Face users but no generative interface, inference-time retrieval, tool or function calling, autonomous planner, or agent coordination, so Q1-Q5 resolve NO on the published evidence and the decision tree ends at Q6 by elimination, as in the hugging-face-malicious-model-backdoor precedent. Code executes in the deserializer, not through model tool use, so the loader compromise enters as Containment, As, and Cp evidence. Tier 3: Tier 3 Internal: the consuming environments are practitioner and engineering hosts inside an organisational boundary, matching the Tier 3 class used for the same consumption pattern in the hugging-face-malicious-model-backdoor precedent; the assessed path is not public-facing and holds no direct decision authority over the public.
Documented attack or failure path
- The adversary embedded a reverse-shell payload in a pickle-serialized model file, designed to execute when a user loads the model; ReversingLabs found two such models on Hugging Face.
- The models were uploaded to public Hugging Face repositories; neither attempted to mimic a popular legitimate model.
- The files were deliberately corrupted so that deserialization fails only after the payload has run; Picklescan, which Hugging Face uses to flag malicious models and which relied on full deserialization, did not flag them.
- A user relying on the repository who loads either model executes the payload during deserialization.
- The payload connects a reverse shell to a hardcoded IP address, giving the actor command-and-control capability on the loading system.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- After ReversingLabs reported the finding, Hugging Face removed the models and changed Picklescan to catch this particular broken-deserialization technique; the record notes that other malicious pickles may still evade it.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 3 MVT 0.40 indeterminate | |||
| Ro-5Supply-Chain Artifact Admission Integrity | 0.25w 0.20 | 0.25 anchor: some admission screening existed for the model-artifact class (a hub-side static pickle scan), but there was no signature or hash verification and the unsafe serialization format was permitted and executed, so both observed artifacts were admitted. Not 0.00, because a scan did operate on the artifact class; not 0.50, because no integrity verification on the primary model channel detected the payload. Moved from Ro-4 on the 26-sub-metric basis: the evidence concerns admission of an unverified executable model artifact, not content poisoning. | The only screening in the consumption path, Hugging Face's Picklescan scan, did not flag either malicious pickle-serialized model because the files were corrupted so that full deserialization failed while the embedded payload still executed; both artifacts were admitted to the public repository and remained loadable until ReversingLabs reported them. The loader executed the unsafe pickle format in-process with the user's own permissions, and the record shows no signature, hash or publisher verification before load.source: secureflow/atlas |
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is the pickle model-consumption path (hub Picklescan screening plus in-process deserialization by a user's loader) whose output is a loaded model object or a reverse shell; the record states the behaviour of the model weights is irrelevant to the failure mode, so no natural-person allocation, ranking, classification or description and no protected-class proxy is in scope. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.75 (midpoint 0.37), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.25 | The 0.00 anchor: no effective scope boundary held between the model-loading step and the host's execution and network resources. The 0.25 anchor requires a basic boundary that is merely enforced inconsistently, and none is evidenced on the observed path. | Loading the model executed a reverse shell to a hardcoded external IP address, which ReversingLabs states grants the threat actor command-and-control capabilities on the victim's system; no sandbox, egress restriction, or other scope boundary between deserialization and host execution or outbound network access is described on the observed path.source: secureflow/atlas |
Unknown, not N/A: 16 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-5, Cn-6; NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9; excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.20 | The load is initiated by a user who chooses the artifact, which is the only human decision on the path; once initiated, deserialization runs the embedded payload without further confirmation. No tool-calling, transaction, or autonomous pipeline authority is evidenced, so the 0.50 human-on-the-loop anchor is not supported. |
| AsAttack Surface Exposure | 0.75w 0.25 | The consumption channel ingests anonymous third-party artifacts from a public repository, screened only by a hub-side scan that the observed artifacts evaded, which matches the 0.75 anchor's external ingestion from partially trusted sources. No multi-agent, MCP, or untrusted retrieval surface supports 1.00. |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.25 | Remediation is deployment-infrastructure work rather than model work: refuse pickle-backed loading or require non-executable formats, add pre-load scanning that does not depend on successful deserialization, and isolate first load with restricted egress. No retraining is implied. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.09 | coverage 0.11 (2 of 18 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.10 | Evidence dated 2025-02-25; age 600 days on the workpaper reference date. Components: T_calendar 0.10 · C_event 0.35 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from the MITRE ATLAS incident date 2025-02-25 (recorded at year granularity) to the 2026-10-18 evidence reference date. C_event 0.35: malicious artifacts were live in the production distribution channel the assessed path consumes. C_monitor 0.65: detection came from external research, not from the consuming environment. C_evidence 0.85: the record states that pickle files remain fundamentally unsafe and that other malicious pickles may evade Picklescan. agentic = false and baw = false: the artifact is static and the path has no runtime tool, credential, memory, or configuration mutation. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.15 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.7 midpoint, interval 1.4–5.9; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-001.005 | Safe Ephemeral Detonation & Attested Raw Observation ReportingExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-H-003.009 | Model Artifact Static Malware & Unsafe-Serialization ScanningExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-003.006 | Model SBOM & Provenance AttestationExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-003.002 | CI/CD Release Gating, Model Artifact Signing & Secure DistributionExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-D-004.001 | Static Artifact Integrity Re-verification & Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-I-001.002 | MicroVM & Low-Level SandboxingExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-E-002 | AI Runtime Process, Lease & Pod EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | ACI:containment/behavioral re-attestation ORP:Rf remediation evidence |
| AID-E-003.003 | Confirmed Malicious Code & Persistence EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0031-malicious-models-hugging-face), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
WHAT THIS CASE TEACHES
A scanner that must fully deserialize an artifact to judge it sits on the wrong side of the code-execution boundary: the evasion holds Ro-5 at 0.25 only because a hub-side scan existed, while the loader compromise is carried by Containment rather than by any model property.
Sources: AIDEFEND SecureFlow — Malicious Models on Hugging Face · MITRE ATLAS case study AML.CS0031 · Malicious ML models discovered on Hugging Face platform (reversinglabs.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0031 (incident) |
|---|---|
| Target | Hugging Face users |
| Actor | Unknown |
| Reporter | ReversingLabs |
| Primary evidence date | 2025-02-25 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | AI supply chain |
| Risk impact | Model poisoning / integrity, System compromise / RCE |
| Affected components | Hugging Face model repository, pickle-serialized model files, Picklescan malware scanner, model deserialization and loading pipeline, reverse-shell command-and-control payload |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Embed Malware in Pickled ModelThe adversary embedded malware into an AI model stored in a pickle file. The malware was designed to execute when the model is loaded by a user. ReversingLabs found two instances of this on Hugging Face during their research. | AML.TA0001 AML.T0018.002 |
| 2 | Publish Malicious Model to Hugging FaceThe adversary uploaded the model to Hugging Face. In both instances observed by the ReversingLab, the malicious models did not make any attempt to mimic a popular legitimate model. | AML.TA0003 AML.T0115.001 |
| 3 | Evade Picklescan via Broken DeserializationThe adversary evaded detection by Picklescan (https://github.com/mmaitre314/picklescan), which Hugging Face uses to flag malicious models. This occurred because the model could not be fully deserialized. In their analysis, the ReversingLabs researchers found that the malicious payload was still executed. | AML.TA0007 AML.T0076 |
| 4 | Compromise Consumer ML Supply ChainBecause the models were successfully uploaded to Hugging Face, a user relying on this model repository would have their supply chain compromised. | AML.TA0004 AML.T0010 |
| 5 | Execute Payload on Model LoadIf a user loaded the malicious model, the adversary's malicious payload is executed. | AML.TA0005 AML.T0011.000 |
| 6 | Establish Reverse Shell C2The malicious payload was a reverse shell set to connect to a hardcoded IP address. | AML.TA0014 AML.T0072 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0031-malicious-models-hugging-face; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0031 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).