Poisoned Pickles Make You Ill
summary
Pickle serialization is widespread in scikit-learn, Keras and PyTorch and it lets arbitrary Python objects — including functions — execute on load, so poisoned pickles can run code that dumps environment variables and exfiltrates secrets. A notebook demo serialises a model, injects payload, serves it and shows a dumped env file. Safer options include ONNX or restricted pickles plus supply-chain attestations and Sigstore signatures (Fulcio/Rekor style) to detect tampering at deploy time.
AI-written summary · about
chapters (7)
- 0:00ML security risks
- 3:58Pickle serialization dangers
- 7:49ML artifact life cycle
- 11:03Mitigating pickle risks
- 13:30Supply chain security
- 19:09Sigstore for artifact validation
- 23:12ML security challenges
related talks
32mPoisoned Pickles Make You Ill- 32mPoisoned Pickles Make You Ill
39mDeath by (Python) Pickle: "Betrayal ML"
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
32mLet’s exploit pickle, and `skops` to the rescue!
25mSecure ML: Automated Security Best Practices in Machine Learning
51mMarshalling Pickles
46mInsane in the Supply Chain: Threat modeling for...