Embed Malware
Think of an AI model like a digital recipe book. Sometimes, a bad actor can hide a 'trapdoor' inside the file. When you open the file to use the AI, the trapdoor triggers, allowing the attacker to take control of your computer without you ever noticing that the AI is still working normally.
This refers to the injection of malicious payloads into serialized model artifacts. Because common formats like pickle allow for arbitrary code execution during deserialization, an attacker can bundle executable scripts with model weights. The model remains functional, masking the malicious activity while providing the attacker with a foothold for command and control or data exfiltration.
The embedding of malicious code within AI model files exploits vulnerabilities in insecure deserialization processes, most notably within the Python pickle module. By crafting serialized objects that invoke arbitrary system calls—such as exec()—upon loading, adversaries achieve remote code execution (RCE) within the host environment. This technique ensures the model maintains its intended inference capabilities, effectively functioning as a trojan horse to facilitate persistence, lateral movement, or exfiltration while evading detection by standard model integrity checks.