本文针对 Hugging Face 等预训练模型中心的恶意代码投毒风险，提出融合脚本提取、反序列化、污点分析与模式匹配的 MalHug 流水线，并经大规模工业部署验证有效。
摘要：
预训练模型（PTM）和数据集的激增催生了 Hugging Face 等集中式模型中心，促进了协作开发与复用。然而，近期安全报告揭示了这些平台中存在的漏洞和恶意攻击实例，凸显出日益增长的安全担忧。本文首次对预训练模型中心上的恶意代码投毒攻击进行系统研究，重点关注 Hugging Face 平台。我们开展了全面的威胁分析，建立了模型格式分类体系，并对易受攻击的格式进行了根本原因分析。尽管 Fickling 和 ModelScan 等现有工具能够提供一定保护，但它们在语义级分析和全面威胁检测方面存在局限。为应对这些挑战，我们提出 MalHug，这是一条专为 Hugging Face 定制的端到端流水线，结合数据集加载脚本提取、模型反序列化、深度污点分析和启发式模式匹配，以检测并分类数据集与模型中的恶意代码投毒攻击。通过与领先金融科技公司蚂蚁集团合作，我们已在其基础设施内的一个镜像 Hugging Face 实例上实现并部署 MalHug，且该系统已持续运行三个多月。在此期间，MalHug 监测了超过 705K 个模型和 176K 个数据集，发现 91 个恶意模型和 9 个恶意数据集加载脚本。这些发现揭示了一系列安全威胁，包括反向 shell、浏览器凭据窃取和系统侦察。本工作不仅填补了理解 PTM 供应链安全方面的关键空白，也为增强预训练模型中心的安全性提供了经过工业界检验的实用解决方案。
英文摘要：
The proliferation of pre-trained models (PTMs) and datasets has led to the emergence of centralized model hubs like Hugging Face, which facilitate collaborative development and reuse. However, recent security reports have uncovered vulnerabilities and instances of malicious attacks within these platforms, highlighting growing security concerns. This paper presents the first systematic study of malicious code poisoning attacks on pre-trained model hubs, focusing on the Hugging Face platform. We conduct a comprehensive threat analysis, develop a taxonomy of model formats, and perform root cause analysis of vulnerable formats. While existing tools like Fickling and ModelScan offer some protection, they face limitations in semantic-level analysis and comprehensive threat detection. To address these challenges, we propose MalHug, an end-to-end pipeline tailored for Hugging Face that combines dataset loading script extraction, model deserialization, in-depth taint analysis, and heuristic pattern matching to detect and classify malicious code poisoning attacks in datasets and models. In collaboration with Ant Group, a leading financial technology company, we have implemented and deployed MalHug on a mirrored Hugging Face instance within their infrastructure, where it has been operational for over three months. During this period, MalHug has monitored more than 705K models and 176K datasets, uncovering 91 malicious models and 9 malicious dataset loading scripts. These findings reveal a range of security threats, including reverse shell, browser credential theft, and system reconnaissance. This work not only bridges a critical gap in understanding the security of the PTM supply chain but also provides a practical, industry-tested solution for enhancing the security of pre-trained model hubs.
FLCert: Provably Secure Federated Learning against Poisoning Attacks
Meta Platforms（Meta平台公司）；University of Science and Technology of China（中国科学技术大学）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Duke University（杜克大学）
Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense
Queen Mary University of London（伦敦玛丽女王大学）；University of Oxford（牛津大学）；Huazhong University of Science and Technology（华中科技大学）；Shandong University of Technology（山东理工大学）
EnCAgg: Enhanced Clustering Aggregation for Robust Federated Learning against Dynamic Model Poisoning
School of Cyberspace Security, Beijing University of Posts and Telecommunications（信息安全部门，北京邮电大学）；School of Computer Science and Technology, Huazhong University of Science and Technology（计算机科学与技术学院，华中科技大学）；Department of Electronic Engineering, Tsinghua University（电子工程系，清华大学）
Protecting Federated Learning from Extreme Model Poisoning Attacks via Multidimensional Time Series Anomaly Detection
Department of Computer, Control and Management Engineering, Sapienza University of Rome（计算机、控制与管理工程系，罗马萨皮恩扎大学）；National Research Council in Pisa（比萨国家研究理事会）；Department of Statistics, Ludwig-Maximilians-University of Munich（统计学系，慕尼黑路德维希-马克西米利安大学）；Department of Computer Science, Sapienza University of Rome（计算机科学系，罗马萨皮恩扎大学）
Poisoning Attacks and Defenses to Federated Unlearning
ShanghaiTech University（上海科技大学）；Xidian University（西安电子科技大学）；North Carolina State University（北卡罗来纳州立大学）；University of North Texas（北德克萨斯大学）；University of Louisville（路易斯维尔大学）
Resilience in Online Federated Learning: Mitigating Model-Poisoning Attacks via Partial Sharing
Norwegian University of Science and Technology（挪威科技大学）；Aalto University（阿尔托大学）；Commonwealth Scientific and Industrial Research Organisation（联邦科学与工业研究组织）；University of Southern Denmark（南丹麦大学）
Leverage Variational Graph Representation For Model Poisoning on Federated Learning
University of Cambridge（剑桥大学）；Real-Time and Embedded Computing Systems Research Centre (CISTER)（实时与嵌入式计算系统研究中心（CISTER））；Carnegie Mellon University（卡内基梅隆大学）；Commonwealth Scientific and Industrial Research Organization (CSIRO)（联邦科学与工业研究组织（CSIRO））；TU Berlin（柏林工业大学）；The University of Sydney（悉尼大学）
MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
Institute of Cyberspace Security, Zhejiang University of Technology（浙江工业大学网络空间安全研究院）；Binjiang Institute of Artificial Intelligence, ZJUT（浙江工业大学滨江人工智能研究院）；College of Information Engineering, Zhejiang University of Technology（浙江工业大学信息工程学院）
Defending Against Sophisticated Poisoning Attacks with RL-based Aggregation in Federated Learning
Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing（北京未来区块链与隐私计算高精尖创新中心）；Institute of Artificial Intelligence, Beihang University（北京航空航天大学人工智能研究院）
