A cactus coup at the goldrush saloon: swindling machine learning caches via wagon train

Adrian Wood and Mary Walker present a red team view of machine learning models as a software supply chain attack vector. They explain why ML environments are attractive targets: they hold large volumes of business data, rarely run endpoint detection, and their daily activity looks routine. The talk covers how look-alike organisation names on a public model repository can be claimed, and how a model file can carry code that runs whenever the model loads while its predictions stay accurate.

The middle section walks through building such a model with a Keras Lambda layer that fetches and runs a second-stage implant, and how saving the model under a different file format can get around recent restrictions. Once inside, the presenters describe common findings in shared notebooks, such as exposed API keys for data warehouses, and tools for mapping MLOps services and altering model behaviour. Mary then describes a research project that assessed thousands of model files on Hugging Face, finding very little embedded code and only one sample of actual malware, and how the code layers were extracted and disassembled.

The closing part covers defence: scanning models at ingestion, YARA rules over extracted code, H5 viewers for forensics, and the need for incident responders to learn what normal looks like in ML environments. Sandboxing at scale is judged impractical, so behavioural analysis of suspect models is suggested instead. The speakers note that the offensive code is already published, with defensive code to follow.