捉迷藏的艺术：让基于 Pickle 的模型供应链投毒再次变得隐蔽
The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again
AI总结：
本文首次系统揭示基于 Pickle 的模型供应链投毒面，从模型加载路径和危险函数两个视角发现大量扫描器遗漏，并提出 EOP 绕过技术，实现对现实扫描器的高效隐蔽绕过。
摘要：
Pickle 反序列化漏洞在 Python 的历史中一直存在，虽被广泛认识却始终未获解决。由于其能够透明地将复杂对象保存为字节流并加以恢复，许多 AI/ML 框架尽管知道其固有风险，仍继续采用 pickle 作为模型序列化协议。随着开源模型生态不断壮大，Hugging Face 等模型共享平台吸引了大量参与者，显著放大了 pickle 被利用的现实风险，并为模型供应链投毒开辟了新途径。尽管已有若干最先进的扫描器被开发用于检测被投毒模型，但它们对投毒面的理解并不完整，导致检测逻辑脆弱，攻击者可以绕过这些检测。在本工作中，我们首次从模型加载和危险函数两个视角系统性地揭示基于 pickle 的模型投毒面。我们的研究展示了基于 pickle 的模型投毒如何保持隐蔽，并指出现有扫描方案中的关键缺口。在模型加载面上，我们在五个基础 AI/ML 框架中识别出 22 条不同的基于 pickle 的模型加载路径，其中 19 条被现有扫描器完全遗漏。我们进一步开发了一种名为 Exception-Oriented Programming（EOP）的绕过技术，并发现 9 个 EOP 实例，其中 7 个能够绕过所有扫描器。在危险函数面上，我们发现了 133 个可利用的 gadget，实现了接近 100% 的绕过率。即使面对表现最好的扫描器，这些 gadget 仍保持 89% 的绕过率。通过系统性地揭示基于 pickle 的模型投毒面，我们实现了对现实世界扫描器的实用且稳健的绕过。我们已将发现负责任地披露给相应厂商，并收到了致谢和 6000 美元漏洞赏金。
英文摘要：
Pickle deserialization vulnerabilities have persisted throughout Python's history, remaining widely recognized yet unresolved. Due to its ability to transparently save and restore complex objects into byte streams, many AI/ML frameworks continue to adopt pickle as the model serialization protocol despite its inherent risks. As the open-source model ecosystem grows, model-sharing platforms such as Hugging Face have attracted massive participation, significantly amplifying the real-world risks of pickle exploitation and opening new avenues for model supply chain poisoning. Although several state-of-the-art scanners have been developed to detect poisoned models, their incomplete understanding of the poisoning surface leaves the detection logic fragile and allows attackers to bypass them. In this work, we present the first systematic disclosure of the pickle-based model poisoning surface from both model loading and risky function perspectives. Our research demonstrates how pickle-based model poisoning can remain stealthy and highlights critical gaps in current scanning solutions. On the model loading surface, we identify 22 distinct pickle-based model loading paths across five foundational AI/ML frameworks, 19 of which are entirely missed by existing scanners. We further develop a bypass technique named Exception-Oriented Programming (EOP) and discover 9 EOP instances, 7 of which can bypass all scanners. On the risky function surface, we discover 133 exploitable gadgets, achieving almost a 100% bypass rate. Even against the best-performing scanner, these gadgets maintain an 89% bypass rate. By systematically revealing the pickle-based model poisoning surface, we achieve practical and robust bypasses against real-world scanners. We responsibly disclose our findings to corresponding vendors, receiving acknowledgments and a $6000 bug bounty.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
