Let’s exploit pickle, and `skops` to the rescue!
summary
Pickle can run arbitrary code on load and standard pickle/joblib/cloudpickle all share that risk; skops implements a safe-on-load ZIP schema storing arrays as .npy files with numpy.load(allow_pickle=False), avoids calling reduce by default and only reconstructs scikit-learn objects via get_state/set_state, raising on untrusted types. The library is slower and produces larger archives but works for most sklearn, xgboost and lightgbm cases. A public conversion service runs each job in an isolated Docker space. arbitrary code execution skops ZIP schema
AI-written summary · about
chapters (37)
- 0:00Intro
- 0:20About Adrin
- 1:28Loading pickle
- 3:06pickle is not safe
- 3:48how does pickle work
- 4:17what is important
- 4:35getState
- 5:08pickle
- 6:13reduce
- 7:07pickling
- 8:35other attacks
- 10:05pickle and reduce
- 11:50ASD
- 12:24Load
- 13:34Ficklink
- 14:01Logistic regression
- 14:23What can we do for users
- 15:55SKOPS
- 17:19Dumped Files
- 18:00Shady Files
- 18:22Linear Regression
- 18:52Where is my data
- 19:46Scopes schema
- 20:15numpysave
- 21:32trusted
- 22:10malicious libraries
- 22:35new
- 23:30loading
- 24:05conversion
- 24:54load untrusted objects
- 25:23numpy load
- 25:46xgboost
- 26:03roadmap
- 26:21parallel processing
- 26:41public protocol
- 26:59report bugs
- 27:21load models
related talks
26mImproving production workflows for scikit-learn models with skops
27mPoisoned Pickles Make You Ill
32mPoisoned Pickles Make You Ill- 32mPoisoned Pickles Make You Ill
29mScaling Python-Powered Machine Learning With Snowflake
39mDeath by (Python) Pickle: "Betrayal ML"
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
17mProductionizing Data Science Workloads