Poisoned Pickles Make You Ill
summary
Claim: Python pickles can carry arbitrary code so a serialized scikit learn model can be poisoned pickle to exfiltrate secrets. Demo modifies the model's __reduce__ injection to run os.system and write environment variables to /tmp/tx.txt, then serves models with mlserver to show the tampered pickle executes on load. Mitigations shown: use Scopes or convert to ONNX and add sigstore attestation at training time so production rejects tampered artifacts — demo verification works.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:05Security in ML overlooked
- 2:09Python pickles and risks
- 3:54Pickle poisoning vulnerabilities
- 8:10Pickle limitations
- 9:14ML deployment architecture
- 10:56Live demo: poisoning pickle model
- 13:24Exploiting pickle vulnerabilities
- 14:08Mitigating risks with Scopes
- 15:31Real-world poisoning case
- 16:56DevOps for ML security
- 18:19ML supply chain security
- 20:26Sigstore for ML signing
- 24:24Live demo: signing models
- 26:52Verifying signatures in production
- 29:00Next steps for ML security
related talks
32mPoisoned Pickles Make You Ill
27mPoisoned Pickles Make You Ill
39mDeath by (Python) Pickle: "Betrayal ML"
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
25mSecure ML: Automated Security Best Practices in Machine Learning
46mInsane in the Supply Chain: Threat modeling for...
32mFuture Open Source LLM Kill Chains
28mFlawed ML Security: Mitigating Security Vulnerabilities in Data & Machine...