Loading Models, Launching Shells: Abusing AI File Formats for Code Execution
C Parzian analyzes weaponized machine learning file formats, demonstrating arbitrary code execution vectors in widely deployed AI frameworks.
Summary
The Blind Trust in AI Model Weights
C Parzian investigates the rampant assumption of trust when data scientists and developers download pretrained neural network model weights from open-source repositories and public hubs.
Dissecting Dangerous Model Formats
The presentation uncovers unsafe deserialization vulnerabilities, embedded script execution, and parser flaws across popular serialization formats including Pickle, PyTorch checkpoints, and custom tensor structures.
Exploitation Scenarios and Defensive Hardening
Parzian demonstrates realistic supply chain attack chains executing arbitrary shells upon model load and presents best practices for safe loading using formats like SafeTensors and isolated sandboxing.
Related talks
Main Stage·20 min
ColdwaterQ
ColdwaterQ demonstrates backdooring Python pickle files in machine learning models, weaponizing PyTorch and TensorFlow weights for silent remote code execution.
Main Stage·29 min
Ariel Herbert-Voss
Provides a structured adversarial ML red team methodology for attacking production AI systems beyond naive input perturbation.
Main Stage·37 min
Liu Yan
Liu Yan explores transferability of adversarial examples to attack cloud image classifier at DEF CON China 1, examining ai-security and practical defenses.