ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks
2026-07-20 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied how attackers can hide harmful code inside pre-trained machine learning models shared on popular platforms like Hugging Face. They created new sneaky attacks called SHADOWPICKLE that can bypass current security tools designed to catch malicious models by exploiting how these models load additional code during use. They also built a tool called PICKLEBENCH to test and compare these attacks. Their results show that existing scanners often fail to detect SHADOWPICKLE attacks, highlighting weaknesses in current defenses and suggesting ways to improve them.
supply chain attackspre-trained modelspickle deserializationremote code executionmachine learning securitymodel hosting hubsmalicious payloadvulnerability scanningbenchmarking toolscode import mechanism
Authors
Dhruv Pradhan, Sarang Nambiar, Ezekiel Soremekun
Abstract
Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during deserialization. Additionally, we provide PICKLEBENCH, a dynamic and extensible benchmark for automatically injecting SHADOWPICKLE into arbitrary benign PTM models. Our evaluation shows that SHADOWPICKLE evades ten SOTA scanners, and four model hubs. SHADOWPICKLE (Overwritten) has a 63% evasion rate across scanners, and up to 50% higher evasion rates than existing attacks. Besides, PICKLEBENCH is up to 25.6% more challenging than three SOTA benchmarks. Finally, we provide security recommendations for mitigating our attacks and improving the effectiveness of existing scanners. Our findings highlight the limitations of existing PTM scanners and suggest directions for improvements.