Death By (Python) Pickle: "Betrayal ML"

The talk opens with a light analogy: a machine learning model is a set of learned behaviors that can be loaded into another system, much like uploading a skill. It explains that a pickle file is Python's serialization format for packaging such data, and that the danger starts when a file meant to hold only data also carries instructions that run on load. The speaker points to public model hubs, which host large numbers of these files, and notes that many are too big for common sandboxes to analyze fully.

The middle of the talk walks through examples of pickle files found to create processes, reach the network, download a backdoor and run it. The speaker contrasts this with supply chain attacks on software releases, where a single partially signed package carried malware. He argues that a scanner reporting "no malware found" may only mean the file was too large or in an unsupported format, and that hash and reputation checks miss new threats. He describes watching for behavioral changes across releases, such as newly added checks for virtual machines, as a way to spot tampering, and mentions software bills of materials and emerging AI bills of materials as ways to inventory components.

The closing section returns to the basic question of what a pickle file is and reinforces that a model file should contain only data. The practical takeaways are to treat model files as untrusted code, to look beyond hashes and reputation when analyzing them, to keep inventories of AI components, and to monitor how software behaves from one release to the next.